{"type": "bundle", "id": "bundle--b5eadcb7-03b6-4037-bb8b-6a86ab3d7fcb", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15", "name": "DigitalOcean London", "latitude": 51.5177, "longitude": -0.6215, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "GB"}, {"type": "location", "spec_version": "2.1", "id": "location--a9163243-55d6-4d38-8102-2aacd520db83", "name": "DigitalOcean Toronto", "latitude": 43.6547, "longitude": -79.3623, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "CA"}, {"type": "location", "spec_version": "2.1", "id": "location--db6d2d8a-77c3-4583-91c2-b1b98217395d", "name": "Vultr Melbourne", "latitude": -37.8136, "longitude": 144.9631, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--cf340c00-42b1-4f2a-a395-00f0b94b9f08", "name": "Vultr Paris", "latitude": 48.8566, "longitude": 2.3522, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "FR"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--4d8f6f09-74eb-4a26-b872-5c3beac79aff", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--cca27f04-b20a-42a3-8860-456fbcf647f2", "name": "DigitalOcean London", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0177ee78-32bc-4ece-8b86-6fff305b899e", "relationship_type": "located-at", "source_ref": "infrastructure--cca27f04-b20a-42a3-8860-456fbcf647f2", "target_ref": "location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--da426486-6a36-47d1-9335-b787f5d3b31d", "name": "DigitalOcean Toronto", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--49a4d0fd-9ca5-48fa-b8de-00907b619a31", "relationship_type": "located-at", "source_ref": "infrastructure--da426486-6a36-47d1-9335-b787f5d3b31d", "target_ref": "location--a9163243-55d6-4d38-8102-2aacd520db83", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--63c9a44e-921d-43b6-b489-77279a45f619", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--a7520fd0-8238-47a8-bdc9-c3c4bbd65229", "name": "Vultr Melbourne", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f2dec1ce-a3ad-4215-a7c9-927e1664c68f", "relationship_type": "located-at", "source_ref": "infrastructure--a7520fd0-8238-47a8-bdc9-c3c4bbd65229", "target_ref": "location--db6d2d8a-77c3-4583-91c2-b1b98217395d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--3aa3826e-111e-447f-b47c-d68b9e82176a", "name": "Vultr Paris", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f742a4f5-548b-411c-9305-743b182e0f27", "relationship_type": "located-at", "source_ref": "infrastructure--3aa3826e-111e-447f-b47c-d68b9e82176a", "target_ref": "location--cf340c00-42b1-4f2a-a395-00f0b94b9f08", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--bdbb0df2-8c45-4204-998c-24a9eb4e5757", "name": "CVE-2010-0738", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0738", "external_id": "CVE-2010-0738"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--308f0a38-05c3-4893-bcab-e6bb9056cbb5", "name": "CVE-2021-26855", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--00b841b1-a0bc-4dec-bc95-bbd0cffd3797", "name": "CVE-2023-1389", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ee40e51-5906-45f1-acaa-1535a4e37a6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.222.92.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1261778-9a23-448f-b0ee-28807740e9b8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.53.229.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d24ea3e-1354-4df2-9218-aa058dd63bcf", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.65.145.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee048713-e742-484e-a34e-c084c828536e", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.95.193.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5664bdad-e95e-466d-a6b9-797eac6452a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.12.231.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2390710-dbcd-470b-82f4-b67fa14a11f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.27.18.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--193f4ad1-b0b2-446a-b391-2cb44dd5c1c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.28.153.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f382ab08-87fc-4b70-b90f-21f01483fe35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.28.191.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21036317-7ff7-447a-97b2-79f99cebcc4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0650c81-d7ee-4a73-905c-dc1aebc8c96a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c33579ea-c461-45d0-8e91-bd601ea752ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b57f58c1-56fd-408d-92d4-56c8d437c7a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec814fd2-b1b3-49f5-a124-b72047bf20ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1031af0-3da2-4069-b801-a9214ebd850a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec23214c-539e-45a0-8d03-1348259904a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c049cfeb-c7d7-4356-83ba-43c90113bf54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d40de5da-22b2-4344-a2aa-bed5025c993a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ad2d517-835c-4ff0-ab7a-c4909a1c5c66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37a6355b-035b-4d27-8c39-e255643ed96d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--097958e8-91cd-4a54-b0fa-df9e06cb190a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--278883d2-308b-4845-927f-f8ec50345229", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--528312aa-50fd-4ef6-9d0f-9de0c268442a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--672549c8-c2b0-4775-b322-85a78b20a4ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba8a318a-2a54-4984-8dc1-cd4144732719", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46767c48-d7c6-4086-88e4-deb8ee530058", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5628a5d-f7e9-43c4-818d-696a2a002206", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d52040f-21ae-4189-a0a5-1ab6c8f76b70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f25dd2b0-a8d8-40e9-b2f3-3aea4553f11e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0acff69a-57c4-4371-aeb6-9af8949b04e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.49.117.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24f0f1a5-ffc7-4037-a154-4599a33f03ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.50.17.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b50144e6-e51b-43fb-8f22-0498397a52e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.51.6.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--677b3940-aeda-4c30-ba7f-2f0c070991c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.54.47.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1dc0c30-8ce9-46eb-9213-fd03e9ad1665", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.30.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75b11aa5-ed0a-469c-8c7d-bdd96cd61a73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.200.236.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8e1792c-e56b-4e30-8347-51fece593ab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.235.198.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f05f670-2a41-431b-914f-91ba8822807c", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.249.63.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b8f7956-d618-4262-928e-f7a5899f8246", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.248.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04dab19f-5648-4bde-bffa-d508237c09bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.105.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a7559ce-c8ff-41b4-8bed-f317ab475385", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.106.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a720b153-e761-49de-9ce9-04b118e32094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.107.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcf7eaea-92e8-4c5b-942a-1fe70b69c3c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.107.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db365646-a426-4d67-888c-91f4ac1d3dc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bb35cc9-9b4c-40bb-8401-5499480e1687", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d91f1f5d-9924-4381-baa7-83e3ebc89cda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.110.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd3ff821-ed4e-4ef1-9329-6b898bf204e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.112.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5ad7c2d-d7d9-49e6-a910-8ec54812ad75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.114.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9726814a-7f6d-48dc-affc-85b6aea240a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.114.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a59d73e-b808-43cc-abff-67d9ffdc7287", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.116.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d796c7b6-a3ff-48bf-b5a4-e804dc254f9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.118.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c337d1f-c024-4eff-94c5-4f166c9d8fae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.121.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6eb1358-96f9-483d-b797-a8fe8476971e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.124.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de3ded42-db36-460e-8756-804406fcda73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.127.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7195345f-b7c0-44bb-9fe6-232075a95f2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d457171b-ef08-4160-aeae-11aa77a0c9de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2265a20-07e8-4ba4-94ec-014a16bcfc1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e48f9ea-9d92-4513-bf65-e9d66b52219f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74168bee-79c4-4629-9ce0-3ad54937c07e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.43.6.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45862e54-1cd1-43c0-b307-409f7d3db9e0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.159.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29df5862-245a-4b7f-ba21-254743c7fc5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.8.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--603864b3-9f25-4c56-9eb9-2bda0026e506", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.53.233.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ca71785-07fb-486f-91cf-e3019d817eac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.186.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35ebb346-81d6-48b9-b91b-445124be69cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.200.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d2ceca2-2f1c-4cb7-afd9-046224386d99", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.203.200.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d2ff2c9-c151-4bae-aba9-ac3c3b0c3c3e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.37.156.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd6dd728-e1eb-4ff5-8fab-39cd01d537f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.66.147.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59b08f60-81ce-407d-ac2d-3a240587b24a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.69.167.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6796760-0968-4494-bf26-e84a965b2001", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.88.21.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--500ecc25-d6cb-4113-b4b5-8a03a3228d92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.1.210.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cdd3f18-872c-4c4d-b0e4-847aca92864c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.112.62.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85d7077a-8464-4a1e-9ea8-becf396ebd89", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.118.28.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef866073-c68e-4c82-bede-91d34013c693", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.123.226.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad1ea469-4a83-408d-994a-88e5bee32d9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.14.32.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa8d0de9-81a2-41a2-86a2-26a957ccc0d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.14.32.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4d79be9-1544-4c3f-b332-8f9461e545d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.149.26.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4d72b36-4a02-4fca-bcd1-1fe1d6afde73", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.151.140.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54f9e3be-678a-4707-bee5-b607476720f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.155.221.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01cb0519-be61-42cd-9671-7c206782ce89", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.157.48.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d97bb7a-2a20-481f-912c-1293aae236cb", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.165.32.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a57dad7a-8643-496a-803a-c00045f0fed9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.166.103.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--712fb0cb-b3ce-478c-8d20-8a3b0c568aa1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.168.66.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63adc6a9-06be-482a-bb16-5b5358132039", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.173.154.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48e78047-a664-4b03-a34c-a531e90f9125", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.173.227.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9427b744-5c11-4014-8986-5de4bce3ddde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.18.14.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6e5dc71-c6db-41fe-b241-14b3256f5884", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.180.165.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dbaaab4-0e13-4b7b-af5e-57f181c90217", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.183.62.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ccf1ed0-564a-4a4f-8a65-3d4a644610bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.186.77.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b0b534e-c07d-4c7a-972a-1cf29759af18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.191.135.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6570fc76-14dd-4c16-bc53-da77c6ebb0af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.59.0']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22f3ed35-d004-4c03-a431-db941864c1ee", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.210.21.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18d991f4-6ebd-47b8-9f4f-82efd9ed1bdc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.214.5.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e75ecf18-7bcc-48d6-b55c-f018c4761961", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.215.74.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--238b2efa-5067-4583-9036-13e3ed1f318e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac90744c-692c-420c-a6a1-d91b56cc61fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c49a58c-ee97-4776-9303-aaa84daecd3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db040c63-0d14-4b5c-b0be-e243674ba002", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7f9b171-3bc8-4122-baa2-56abced5c378", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebb1ddf3-3f04-4204-aa00-d9a32c01b951", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc3f482c-cd93-4f73-adc5-0df782b393e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--032e2c13-72d6-4690-a441-9b7a7f5d6860", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c098317-bab7-46e4-a825-ace43b89d944", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7df88d1-c305-42f8-818a-42a2728b170e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a7ce29f-dea5-4dfb-b553-3bf74e9cec41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1b74821-8e88-4c43-9c1d-a88e7b639026", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d262ec3f-33c9-442f-8139-97c4ad93d748", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae5c380e-a580-4968-96f1-3a71fbd1d12c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b1cc9f6-b172-4169-8d60-361622851ceb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--114ddc48-8a9e-4604-8292-9d4c0eb09806", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d44e6921-16a9-49e7-be08-a6597c93dfec", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.243.26.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e2cd45d-a3bc-4451-893d-dcedef76dcb4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.250.11.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eb9ab67-cd86-4d00-98b4-6d6a4b5b19c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.39.225.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2e96d4b-250e-4e34-b0d8-016cedefc294", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.43.8.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95124f78-e3c1-4eb6-b22c-5f0b4a19b5b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.54.101.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef81aaf6-abbe-495e-baba-081543ecdde0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.57.224.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1daff2c-244f-40da-940b-f172d22d85d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.7.60.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5565cb70-071e-4760-a43f-dca8a8f013ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.75.71.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d622722-9dee-437a-af2d-e74dc27a21bb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.78.0.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a96799a-f90e-491b-b12d-fb74aeb8b19d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.9.204.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5113825-544b-4333-80d0-a53efcc04b8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.128.144.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d07d1b0a-74e2-49aa-b630-c1e5e036dd3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.182.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df757268-c07a-46fa-9fe8-b829c532131b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.69.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b2cd447-ba62-4ae0-9420-6fe72d90164f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.94.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2709dcf8-cadc-4475-9cfa-eb3cbe015a59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--053bc98a-8f06-45b1-8ec5-cb90f624c06d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.42.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed585508-6fd6-438c-a230-28736fdda256", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.167.64.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3752fee-43ee-46ef-8ac8-ccaebd351032", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.192.2.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5fef665-9bf0-45e0-ba79-3b9805fff2d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.154.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--502f0955-a40d-4fa1-8bc8-adbd7208ea41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.8.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b8ea982-4e4e-431f-8df8-c1c0c83ed065", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.199.193.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea0ab64d-5091-4884-9608-d8005ec1d4d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.210.140.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--079e621d-563a-49a9-9368-1d68674d47f9", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.225.143.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ca4fe6a-7515-4855-975c-c7a7e456355e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.232.79.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f90a058e-49b7-43e8-941a-413305f50157", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.236.206.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41e71e0f-ee5d-41c0-8802-447ca193ff18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.237.147.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d060301b-e786-40d8-88d6-84bc19541c71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.237.156.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f873054-8580-486d-a83d-694100a9b6ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.237.57.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3625c709-9311-4e12-af01-c8a2f4aeff56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.35.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d349812-9b97-4495-b8ee-9f60a797a230", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.35.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68921cc8-13b1-4a12-bfdb-02b0a9ed4e72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.37.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8ba32dd-66fc-42ec-86d0-676aa9523625", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.38.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b8cbac5-92d6-4d2d-8193-78a2c4f5b96b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.120.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c594bfb-0380-4324-aa71-ecf65210a9f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.130.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df08f148-21bf-48ed-8dab-18d3b792862a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.157.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d7c5fc7-00dc-4a72-8b57-cf5751bbfa29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.2.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86d1760b-41ad-403c-8acd-a17d64b3f979", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.253.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0dd2ca0-7555-4262-a15c-ed613613fbe9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.74.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--322b67bb-f41c-472e-9452-0b6a9643e749", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.30.51.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--890bddc9-6980-42df-9357-4f75f13e4852", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.112.21.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53dc3ace-522e-4d59-94f2-4361850e697d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.128.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfa66f3f-582d-4e79-b21e-6fa5de57a151", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.123.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5831c389-cc63-4235-bdba-b0908984bbfd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.227.33.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8199d353-ac3f-447f-870e-32c845deb509", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.139.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7b4b5df-678c-40a8-9d98-3d16d753aa6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93d45633-d143-4d43-ba5a-4759a76360c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0742fa41-fe70-46d9-bd0f-365b6c30120c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d4b0555-8532-4550-b65a-57a3c3559ffb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--479581c2-4808-4b6f-9479-8963820a6816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b65d9369-6af9-4921-a7d1-a7129455f356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.169.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dca5f67-9128-45ce-bedd-3aace0c9d4b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.176.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e6fe064-e0e7-4b84-a3da-3d28f0a2c8f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.176.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d139c82-4c0c-4355-89ef-3f579d1bf949", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.185.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8595a290-92d8-4c43-a344-f3f5700a2c10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.189.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22989902-88e9-469e-bc4e-4d6248ad7a70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.191.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20d7e9ee-1dd6-4f19-b06f-cb0b7e8a6817", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.100.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea71c784-3f52-44b6-ba19-635e65f2942f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d59c854-8d30-40c6-8152-99e4a00e417d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f190ea5-a836-4c77-bf42-7f7fa02e3834", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f188209-9547-43fe-b6ad-3421e77fabd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.102.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccb5a84f-b084-4d43-884e-3e790cbeeb55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.102.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7590df9-d375-44d1-aba6-58bbb530faae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.102.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21c7cdd0-51dc-48e3-9d4e-fa101ed76cd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59fa0e90-4088-42d8-9c56-34850731fd3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b047d9bf-0b49-4bf1-b375-9aa36f95d295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6168694-bbf4-4fe1-993d-d6af1fea42bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51bd09ed-5301-44a8-9970-46d246806121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d6c1535-6e92-440c-b45c-f55246a2a5ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23c4d1e1-7920-4606-bd30-228683de5975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.104.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeec6a97-3bad-40e1-a915-8c906c61576e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.110.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7017ed0-191b-4398-9dd8-4e658dec2adf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.112.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a47e766-861f-4e71-b9f8-15368ee2698e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.117.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24d8e207-84d8-4c85-9a46-07df1a9295ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.146.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44484713-27db-4aca-8c9b-038fe8cc88ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.96.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ded44ce8-40e0-431e-904c-2833ea5ba819", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bfb3afb-fd69-422d-9d31-e681b5aa4abb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d782133-e8d3-40ed-99ad-51570bd16ff7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98c65ceb-c786-43fe-b404-af1a762fcefd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec313083-e237-4f28-98d6-0f3aab6fe6a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d3b4002-7e60-48ff-aad4-53f3ccdf0848", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.98.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66024c97-7d71-49d0-adc9-92ef89ac38b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.98.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0ff9a34-ed71-4428-b7cc-3aa780b03265", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.99.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e5706a2-7e08-4cfc-9a5b-85a225533b39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.155.56.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067218eb-758b-4f1d-b95f-b9e26676744b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.155.97.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d6aaa15-7c23-485a-885f-1ecbc1dbd991", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.170.1.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dfd81c0-6a6d-4134-83aa-7f6dc2811023", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.170.247.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff283ae0-9777-4843-96ee-af4b83ca7956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.173.122.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d17102b-4081-4139-966c-88ca6d030832", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.174.90.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df247a0-a11f-468e-ad49-2cd5e2ed570b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.175.156.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccbeea64-1b7d-4735-aeba-f5a025d91972", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.175.53.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0cd52a8-c951-498a-a387-1b21be53dfe7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.180.69.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8104b93-73db-4bd7-832c-8aa429815914", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.22.150.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48182d62-baa2-4715-a9ba-d6cadda36754", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.165.160.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--553d820b-04fa-454e-9c8c-36e846dca080", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.61.198.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e878ff3b-34a8-447e-a2fc-0b453f798fc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.209.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af7a5c48-8b85-4396-afa2-c9efcbd0a284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74d7d87e-69a6-40d4-93b4-69a5cb95306a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d789aaa8-97c5-40b3-8d33-432dd2f9636f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b11dd782-7b30-4a13-8621-521edbbbb8f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.167.249.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a682285-4498-4933-819b-0ebe28a30b58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.94.87.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5430c73-48b4-4566-a667-0300a29fc2e6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.35.80.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaac5314-17c4-4d2f-8aea-b959ba6e3ca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.113.89.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03434a8e-f8ae-4e8a-8685-e327cd54b168", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.198.221.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a26f3917-e275-4838-a1b5-5b8a102359b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.90.159.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1fe3289-c7c8-4d76-89f2-2eea3956a888", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.164.20.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89ed9e88-9d75-403e-9740-f8049abce8b1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.219.104.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2e58b63-32fb-4e13-b36f-af3ba9c37a68", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.219.151.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7253a2a0-8fa7-4433-934f-1d3f21f062d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.242.232.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97200a72-9030-47f7-86e1-58fe88272500", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.27.108.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54c5ff1d-153c-4e04-81c0-00d71910c91a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.46.214.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dea9dab-92b4-44e5-b927-d10d3ff6f2a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.78.1.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--278d3407-169b-4c75-a887-e0ead15b1b40", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.78.163.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a754626c-4c75-4710-a1e5-f30f71652a5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.94.189.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01ed3d6e-4c20-44cd-82db-ed5ad0dbfadb", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.111.215.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b981e32-b4e9-4dfb-adfd-e45fd63fb335", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.170.14.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--146beb80-7246-414c-875a-6fd0772795ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.170.20.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ede04cc7-f1cd-4621-bbcc-06272fbf7b26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.173.63.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ace8c52-6ba2-447f-b845-69477bda86c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.175.44.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46be20d5-f457-43b7-9f79-74ba7e518c9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.181.129.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b5514ce-c573-4a6d-95d0-68bf7a49f5c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.250.184.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5da98a4-3189-4920-ad05-2d29a8a040d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.62.129.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--715697cf-8b26-49aa-81d3-21d0a968d0b2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.111.53.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb1b201b-e768-4033-9f5c-c62a801d8865", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.128.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad0b2f5c-c09e-413d-8537-bbb4ab69fafd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.128.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bb854ae-666c-4beb-b266-ed82db9d1187", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.129.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef2fd1a4-2d52-4c0f-a26f-45a0825e5c0d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55ebf57d-9da3-45cd-842c-055a22bee7fc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.132.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcc8a40d-a60b-4517-8b75-abb11ed16a9e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.132.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92d1c2dc-2534-4343-a42e-03865695fb3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.133.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92da0d35-b9a9-48ea-bfd0-d8c95ad83b78", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.133.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd7694ad-e298-48f4-bd4f-77602de602d1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.134.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06937cd6-fe81-452f-8598-3366b5eef995", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.134.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48e16b6c-7b5f-4b3c-b70f-1f37a22249a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.135.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7762bc9-c4e6-4089-98e4-516281482508", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.136.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b6bdb3e-bf56-4372-848c-c34a9104c5cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.136.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48935b4e-dfa4-4c19-8187-806d0deecbf1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.136.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf9fad15-d0e3-4c9b-9033-9b9961b2f12b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19c2a034-c2a6-4ff0-b8c1-837a22e966f8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3086f27a-82a2-42a2-9c15-efc494ad8340", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--473e2cba-ea32-4c92-af09-fb95fcf7e0a3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.138.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--311c76aa-180c-4e68-8660-60043e8220b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3fd75d4-565a-4079-a017-48aa457cb86e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25e72e8c-b7e3-4492-bde1-ef2bb80cef96", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7b050ba-c7e1-4cf7-881a-99ae8721f96d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae6321d6-cc1b-44e3-873b-438353118868", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.141.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcaaa577-e5d0-4ea6-bae2-89567ff578be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--710ae96e-eb6e-4396-a569-6d63deec4d54", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.143.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7cd4f3d-e4ad-43e9-9488-698fab265883", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.147.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7afc82ad-815d-474c-9443-8c4923f749a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.149.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--936b6dbd-32cb-40ca-b424-9ee449afaf5e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.149.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60b1102e-2b64-4832-8f79-be81edcf67f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.150.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7560e3ea-3672-4c34-a34b-f49534186e60", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.150.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd380e19-384d-4df9-8963-706a57ab3f54", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.150.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c392b91-8ecb-4bde-beb4-a8daf3ca4a3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e141310-d2c6-48ce-9143-89c4657fd952", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a6c34aa-700d-4ebd-a85a-02fe1a171e7f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d1ef3dc-77f7-4c67-a94a-9445e093efe8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--812343ca-281f-461f-97b3-9c545fdf2415", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1e727ad-7eab-47c5-9506-f82332f30983", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26f17626-ed17-4579-86d7-df3df14b8d61", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05f06472-213b-47ff-8974-53f4bd74d859", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.156.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9ff5abf-4fb7-44eb-a11c-b774de48b1f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.156.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--832ae06e-7680-4304-b1a5-4fd0114217bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.157.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c79003d8-e54d-4413-904c-2427e6026b07", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.158.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56fd831a-d6f6-43ae-8f5d-833ae41c0010", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.158.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94e70ad0-3efc-40ed-a5ee-14565e21a5d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de218b8a-e62f-4ad8-a503-4480019bf89d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6257ca9-469b-4062-ad84-9d3a88eb9360", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fe84f29-bbbe-4157-89bb-16648637eb31", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.217.149.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c76d557-fd90-4b04-823a-63b0d95d38fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.217.51.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e5f8192-2434-4d55-99e7-e6de74b149d7", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.33.241.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fc8ba54-ad49-4f0e-b263-9965476a64be", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.178.75.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0e31fd6-726b-4892-b875-0006f556cb39", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.113.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23b5393b-d782-4704-bf14-f9171b49616f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.179.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--906b7d43-3d26-4218-baf9-aec6e760449a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.223.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f6bbd28-f512-40e2-a101-04f2c9701866", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.52.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7878159-783d-4e00-acbb-496aca181156", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.54.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30bf861e-2c1a-4912-a1f9-20e11d55a7b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.83.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--110d6da1-b3fd-470b-97d7-1f3f9fa78694", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.191.22.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c8a774f-0b38-4889-9112-f85e789ebcbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.209.174.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8462791-bdeb-4f5f-a640-26801a00ca7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.230.30.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65e52902-1011-4e01-9a77-e17a7d16ef6f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.91.48.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3d8d6d6-a031-41c6-b9f4-3f1ac2f8c043", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.155.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2aa0d9f-5aeb-45c7-83b2-ed319c2ea4f3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.178.155.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--664559f8-67e6-4bfa-a175-dd9131f027ca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00decc35-c55a-484b-8149-032787a09c1c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6106657-75e3-4c26-8230-620d238a0280", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--750d9519-ab70-4a19-b3e5-92caabd4cd59", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92eed769-5d8d-46b6-b89d-0e10bf02d347", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92d516a8-777d-4ac4-a124-93ab27cfc497", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.207.113.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43a9acdb-02ff-4b28-bff0-149981f92ce3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.99.172.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85d052d7-407d-4f4e-a8c0-54e858e2cbe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.11.89.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e07079ee-8566-43e4-b690-cc39dd1f4c65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.14.147.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0473c89-e964-41ed-baf1-c8981de4dcf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.14.154.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2fdf7ee-5552-4971-9c02-8fc2745633da", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.187.180.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12752951-1033-4079-b3e1-37ee0ea9b98b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.33.242.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02f8e4c8-2d04-40a3-a587-89609fe2b5b3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.50.182.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5175d6f-ba0b-4beb-bd32-6d203e9d5b02", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.57.205.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b98c78a3-e16b-45ab-812d-837f0bb7d2c9", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.80.234.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--694e4f45-9678-4f99-8ae7-4b9f35174335", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.145.225.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ebc64c4-bfa4-4f34-88a6-c81de4763831", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.167.224.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ba203ff-d239-4d52-ae01-7a33a81b3807", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.32.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b77f8669-8b7e-4ca1-a39a-eb19747f9c15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.32.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06efadbb-292a-4599-8a03-020562a06ab2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.33.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a568e904-efcc-4c03-afdc-1403de9afd4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dad7f367-2ba3-4b50-b74b-53d8b8a49786", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ed79638-6619-4e56-ade2-bb965a4bdab9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e72db35-c96c-4add-87f2-92b09bb248a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.38.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8959c0df-27ad-43c2-948c-a595920ac322", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.39.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cfd3fc9-2028-4dfe-850e-89740f47fb12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.40.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e81cf067-e363-45d6-a60b-43300369ecc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.43.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d5dbf5d-43fb-47ef-9ce8-cbefd91020d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.47.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd668ad8-1c41-4401-9554-39a30893d32e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a7e1a67-5816-4b6b-bd44-cf6c330ee8ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62834f19-11c9-4ade-bc41-a95d2385f466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd6c04e-c52e-4256-ae10-9739393d7550", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78c02baf-17ba-4f36-9a67-01f2175e551d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f624824-3e40-4815-b78b-dc8fe6078706", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a667b0ec-27ea-4a87-90e1-ce1bb20d026b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2058f03a-cc33-4769-a195-0d2962fc4165", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84f07a6c-e37d-4d55-8b25-e51e6b1cd3c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.58.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2a663da-bac0-48dd-8bf4-92d7b63c73c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.58.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ed57450-2bf4-4126-82cd-7b0aefd7924f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9acc1952-2171-4f23-a2aa-711232f5a1be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--797e12e6-bf80-46e3-9f25-09719b10b07b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89f549df-1621-40c5-a874-6b80ad23230a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.61.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fba5cf37-0f8a-460e-b7e9-bd5e377a3001", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.64.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a9cc54e-3f61-4531-8958-181290af0f03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.64.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b7754bd-0965-43b4-8bad-0c4dd76712fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--042124c3-b663-4ada-9aaa-6c4c59c5ac5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fba2fd4d-4692-46be-a1d5-f2138dfc69e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea451a07-99f8-4642-88e2-b0c2e4f37c72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.69.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a79dd90-e47f-411b-a114-ec823bb4d8d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e019fc47-4e66-4604-b268-4f8817268761", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5aa4d71-94f0-4cc2-9eaa-777c51ec96a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f2ad5c7-79e2-47da-a4dd-e36e45562c07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.233.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ca53d1-def8-4dc8-bb82-86b9ff757b2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.234.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42b1da00-4a2c-43d5-b5b1-86a653ac3106", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.234.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd20021b-a77e-4085-8a6e-a178eb9ffa95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.235.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1bca352-2e47-4aeb-9081-58e28609ce2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.238.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a548516-9393-4534-8eac-9e0cdcffb467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.249.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c8d2709-8c5c-4f65-98fe-197376b0438d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83677e3a-7869-4a91-acc6-d4cb585ccc23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1160ab0-2ada-4d5e-a78d-551d56e042c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceecbe68-e5b5-4493-9290-d29531c79091", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--849642a4-f77a-452d-8c83-93341da5ccbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc890e28-0ff4-4d03-a429-12f6f270e4bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5f6b9ea-adeb-4318-8ee1-8bfd9cb7ed6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14da161a-8d9e-4e4b-a8c4-9a3afa5e1fbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cb7cc33-3f0e-46f9-975b-e7903172dcee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.212.122.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--519c6804-26b2-4bd6-a0c6-cd69b26215a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.104.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1db31047-6aed-467d-8fec-abbe27e3f17b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.104.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7523816c-a9d5-4988-9fa3-a1871b0c659b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.104.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab2b2089-1b9b-429a-bb40-b27743fb3b2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba1f4c1-a9e3-4999-b8e8-88b0d592e749", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8556f03d-5a3b-4e1f-919e-57f675380069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df4c4800-5587-46e4-bc9a-59d79f4d78ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.109.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46a8c423-e84b-41b4-bf2f-cf92212c7ef7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.110.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47e02817-e5ea-4582-b601-124cf7862b2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.37.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adc48c8a-6360-4977-a3c0-ec755eca9ab1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.39.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edf3bbe4-7990-4fa6-b851-8f5dbd7be7aa", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.39.234.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b27c30c-f2dd-4067-9688-3fb7af67464c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.249.100.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbeae480-fa39-4af0-8472-e0db9c8ed8af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.253.93.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae2fdc3b-43ba-4716-8591-7e7af0662e25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.48.134.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ae5efb1-1855-4049-bed6-05d0529576c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '12.79.116.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3786c033-1a4e-41ee-a72f-b3061d541ce7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.240.236.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53435246-0255-4bde-868a-c26830d64d41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.175.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4609ee0-61d6-404d-959c-a03b1ae030ea", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.20.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11f2bd12-f468-4d32-9af9-75381ad05aee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.76.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed5e7f64-2a1e-4f2e-be21-353cc4d8d1e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.134.8.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99bc27a0-221a-4251-bebe-76d218a2ed7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.165.84.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0580b7f7-64bb-401c-9bde-648ee055b6c7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.168.139.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3701a52-8048-44ab-839d-720f54fcb9ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.190.85.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cd7e551-f079-493c-89c6-48c00c6ceb5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.238.155.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2a90251-597c-47a6-bd30-1f377ba28343", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.40.52.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97ff1a4c-c804-4d20-a2be-7cd720900869", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.40.84.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaae5a47-e485-465a-a5c2-75492674fc8a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.181.100.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dd7e66e-0b71-4650-b2a9-f8af05b71e6a", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.225.92.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c4ded1f-0b4c-4d0a-aeb2-249c0838d91b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.242.71.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59694e43-de8e-49c2-a41b-2fb87a872e58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.245.127.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d30cb80a-d524-4e14-8e93-5dae1bd560ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.247.112.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f283cdfe-543b-40d1-9c4e-aa1a8f8ab89d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.96.28.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f03e5ef-7e86-42af-8746-a17ba7dc02b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.96.28.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eba395a6-a1e5-4e78-8d5d-a35656ccbc66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.96.28.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a09e1cd9-1bc6-41a3-8602-b0817ba91167", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.157.223.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc60d2d6-39b5-4c7f-b260-51ba64168f0c", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.165.86.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd6d9f51-7de5-4072-9d76-6e15554b4387", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.17.76.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bed3bb6d-6ff5-4a2a-9976-ff477b32ab7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.178.210.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d2a99d7-8169-4c38-872a-37229d27e913", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.180.182.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38ecef7b-5bf0-40fb-a28e-5411e41fcc95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.200.2.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6e6e681-fc2f-4c90-9643-feb71a6afba9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.21.26.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfafd177-af9d-443d-a718-e51c47bf142e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.245.84.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5231dea5-d8b7-4abc-be57-ee81d3ad78d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.245.84.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c28514ed-26a4-4104-94b7-e829df8cad04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.245.84.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3552823-b134-4786-8c5b-a66ab1e4035d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.245.84.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6f026f4-5e62-400d-a88d-225074a8f6ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.196.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05727bec-76bd-432c-967e-7cd255f38dd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.205.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1a19c73-0f12-406b-b348-9e06ad21eb46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f17ac003-ffc6-46b3-9275-7efc1ba7005d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b9a6e6d-691c-4d1f-97bf-a5a776e498d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c451c81-e2aa-4e5c-ad74-e868b0a03069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab65341-1075-41f2-914c-857ac5628481", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3025096-2676-4d55-9ddf-1fc30fe0e55d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.117.192.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6808676-4e2e-4ab6-a951-336ecf9ba2a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.117.192.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc36e996-e6c9-4455-af20-32490dc544d8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.13.124.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47fac9ed-20c8-4f01-8236-868ed79855a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.223.102.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53810b72-a152-44a2-ada8-15b0778b2d08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.227.31.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f65f4ff6-c514-4515-9282-2dda0a5794b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.111.13.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82eedef7-9d33-453d-aca1-174b8887f215", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.124.175.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47ed009f-3918-4123-a841-c31ce1ead1dc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.138.175.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18659e71-ad64-4afc-9e59-b4aa1c59b848", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '127.0.0.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14906077-a0ee-4936-a479-a25bd2a1003b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.0.104.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba8b4a60-771c-4fa6-afee-ea4ca829cfdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.1.34.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c36e8af-dc09-4a72-acde-5d011c639d2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.106.221.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de63fe7e-0aa5-480e-abfb-0988ce79618f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.226.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf7426c5-db4f-4ce0-8eee-b3f15097a1b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.227.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e33643ad-a9aa-45a1-8463-9d1567c81528", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.227.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--012d7dd0-d464-453f-a154-a99a4f18ad63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.229.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c57a6a0f-e3ed-42af-8058-3f8be04ad96d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.232.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c6faf20-8482-49ca-9c89-253b1c0f87d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.233.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96cf1edf-9e4c-4567-a310-75d472f2aed0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.236.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a95bf9f2-3a0f-4e88-9e70-d6a15deb0bb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e23f02d0-2e5c-41e0-94a3-70205e4fc699", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e460473-2b47-49d2-a569-ebd8d6900f63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.239.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc0f3843-e46d-4e44-bd34-9f270c627b84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.239.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ba188e2-78ac-4722-b5b8-104d39ea25d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.239.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7850034-e278-499b-9ab1-3e4fe8569251", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.199.255.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45997937-920d-4725-8b7f-a4610850d2af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.2.204.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26cb6698-42b9-49ab-8e58-8d62650ab4b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.200.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d3bf301-6ef8-4aa4-b1bb-44205331a09d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.200.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a776ff06-b9d9-4d21-8bb6-e124e5d5a66f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.204.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c379eb5-5c43-4d96-8a46-ec9efdf0627c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.100.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--403dd97e-a659-4fc6-bc2f-4e2803633f3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.150.47.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--601a863a-a957-4aaf-b4a7-cd028fbfa76b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.232.165.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e88452-22a5-487d-9ed4-797a8deb8dc7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.28.84.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7840007-070c-4a30-bc1a-2543b4efdcec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.200.100.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e21ca4-fa8e-4739-bc6f-a298c1dccb47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.217.169.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec335ff3-062f-44a3-924f-c9c1728281ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.218.137.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a1ecf26-10d5-46df-9663-b5dfd24f1212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.219.1.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2989759a-5f6a-446c-82ca-7cc8febafc86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.220.97.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ae4e36f-8303-4cab-bedc-5033d07e4ec0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.113.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12b89b3a-5837-42cc-b30f-89bd188bbd5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.124.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--451c8440-9afd-45a1-ab79-16c5b0d3bb35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.124.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f18dbe11-cafb-4877-aa1c-8051d45fd4c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.124.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9cffdaa-e44b-4214-aaae-0920b7125b3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c3b6d64-c2f1-40e4-8bc7-47eaa331813a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a2ed8a2-a727-4641-a2ce-9cd24e4e5117", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d3437be-4c78-4793-b79a-39b0b76c7e6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14474af9-7136-494b-9c41-63565e0c7736", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.161.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e95b0e53-dc5a-45b4-b5c3-c7a2f9c68abf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.162.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6028ed13-850d-470d-a039-d402af3a5a3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.211.60.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7f2d8cd-9d54-4aa7-b180-ccccde4108a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.159.24.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df01a791-ebd3-4367-8174-0f2a93ab98f4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.243.206.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36793193-9418-4801-915d-25bd1c10bc92", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '133.18.181.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e76771de-7542-4124-96c3-8800453e465d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '133.232.142.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b934540-7aec-4aff-8973-d96c540ff3fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.125.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--058e53d0-4b1f-4e17-a033-842884453d4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.36.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--853fc4eb-820b-4685-a18b-3ae72be68650", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.50.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8e99fde-a8bf-4e73-adb3-f0182f3fb5da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.153.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4dfdf04-2d6b-4be6-a868-f907836af509", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.158.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dda9ae7b-5918-42c9-a7f1-b80bf11076a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.121.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea5ca49e-52d2-4361-a8cf-2fe300e5620f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.180.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bd6d0f1-b1c9-40dd-9be9-dbb7c10ff07c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.20.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1515d28-65ae-4be4-86aa-19914f642ce0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.112.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82716971-5863-4f77-971d-219c29a7528a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.16.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38543485-2c99-411d-843c-ffe253372202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.96.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94a16976-cea0-4b27-86fa-bf007c7ca462", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.96.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2160512c-40be-4655-aee7-db991a386ea7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.97.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--640e3e9b-0e64-4e7b-816e-448fd7115a6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.181.4.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--532c8197-ada5-46b6-b961-aa1d1f65b6b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.222.40.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e135661-2507-428b-a8d3-1d24ffc824c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.112.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e9184ad-284e-41b1-bf96-4efd92f4c079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.112.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23c2207b-f884-4596-a358-f804bff799e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.122.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9868283-46f3-4bda-9f8e-2a98b6f1f9c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.123.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--517f781e-5b02-438e-ab5f-137eaa8b8c08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--664f339b-37a8-415a-83f1-8f46b0d1ac29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14d7e9fd-0d27-4851-bd04-bd8476e007d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d329219-c132-4164-b4e9-e96c6a80d705", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--309c113d-7344-4e3d-acc4-3f691399fc0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b5cea69-0261-47c4-8311-f4fdb14e098c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80729fcb-6cf9-4a51-8175-f26737a47dee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d66df98-facc-47d9-9ea8-852132a6b4fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73e191f4-bbd0-401e-bb90-5c8f2dab0ba8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d8976f9-56eb-4ba3-944e-99c0ff31a091", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e8ba418-7b75-42c2-ae5e-68795d86663d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1b97b21-75d4-4b9b-980f-08182022086e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d5a9aa7-121c-4df3-a1aa-64d77b1748ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4053fe1-9957-44da-bf4e-e4927e336d4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49a1008d-4ec0-478f-80c9-f4758eb6387f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15f61f03-32d3-4f73-9395-a79dd37a7bcd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.144.33.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fd7b478-ee69-4038-8f5e-ae696be5d98a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.232.11.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb9bcf8d-86ee-48af-b650-a6518b4e3026", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.34.134.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bf00c97-3ef5-4c58-9069-ac6b9d24c38c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.1.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a890999-8754-4cc1-bbe6-064b0d9d15aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.105.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbd94284-6519-4fdd-9f0f-9ef6206aaff4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.165.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--910f4f2d-ab65-4c8b-ada8-02f8e80f7511", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.165.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--929bfe94-7ae0-45e8-b11c-423994fa606b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.226.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2df9d462-376b-4c34-98a4-39be6720e74b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.36.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--924a0afa-70d7-4867-b281-e82166c40343", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.51.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f97fed8-3904-4ff9-bb6a-e80f8d6036a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.226.113.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4079bf8e-c5ca-44e4-850e-6b20cdfc2ab4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.59.54.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bb141a8-206c-4465-a661-f111946d5ff0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.141.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d60714b-92b7-46c9-a346-e8ae52e18576", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.149.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14fb5621-4abc-4ab8-b469-d9aaad92d67c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.16.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e9c3165-addb-429b-984c-8f151cde7e35", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.4.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebce76eb-08cb-4bff-bede-8bcd954fc33c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.199.19.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be20aa0f-f7ca-42f4-86b7-449c457464da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bf41adc-b8ee-41e1-bc27-f26effbfedaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b66c8449-85de-4d83-b584-381db42046c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3f25d2a-7151-4c3c-8f40-0343d3b89827", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2729135-d9b9-428d-abc0-65dac741b8bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.153.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de2fabd6-b5ec-4f6e-bba6-d940e049bb81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.159.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--075b0c36-3909-4a0e-b34e-94e072dec0d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.176.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--782996e3-632a-434d-a4f1-c1e5260e6944", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.182.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fa9cda3-a444-4ba4-b717-e0b7bb2f8da1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.26.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06a5c657-fb66-4049-8478-728d326eda07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.65.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c22f3d0f-9451-450a-bfda-0eb8bb7b4347", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.16.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18fc2fb3-34bc-4600-bf49-9f78fac11276", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.235.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--164c7504-bbc7-487b-94bf-6db26a793277", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24f5631c-0c86-425a-862d-64d45072db06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f77411bb-b08a-4964-8988-962615733f66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.116.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b2b24e9-54d7-47ad-acd1-c2a04a860f47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.70.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33daf9c5-6775-4dd7-beb0-a2ed9d77b66b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.78.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1f5235f-a824-4fae-9ed7-f6b54341fc5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.180.160.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--766ad268-1fb8-43b1-aecd-f8d098bb12da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.169.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca53b401-9a25-4917-97ce-34c385763513", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.173.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad7ef9bf-0aaf-408c-b637-68ab092c6764", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.2.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db4e5fc2-6910-49b2-85eb-3dbf286e1b43", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.4.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9028285-c316-41b2-86fa-1e55136fce76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.56.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfce25f7-ca07-47ea-8bca-993b2b2369e8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.6.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1470d9b2-f39c-4f6e-aa06-00c547f0bb4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.105.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85587ba8-5cdb-4858-9e13-754407fb0057", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.105.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dea3e6ce-faa6-4b18-afa1-5d546e024fdd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.112.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ac72980-fa5c-47fc-8716-48936b4c3e73", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.114.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62d75e8c-0743-4476-be44-621d2c7722de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.115.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6e9831e-bd03-4f24-af91-017294c32643", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.116.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d80a9a3d-1c75-4ca2-9ed4-6070b181372f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.117.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--270ab32a-dc2d-4b3c-bfa0-af69188a6bc9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.117.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c246926c-44bf-411d-9faf-fca14e40e08a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97b10238-2975-413f-bb9f-0ec346b77a13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96a8afd7-ee2d-4576-8bc9-b8d0dee84134", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b04154f3-1287-44bc-8e1a-351982afdb37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.120.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b417e98-2257-4c51-9cbd-d4dd435b5816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.123.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24996955-f15d-447e-8c4b-34344124521f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.127.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81b9585a-1a3a-48ea-bfd4-ed5ff8a64db6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.163.144.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c85162c-3215-4527-8b97-1c37aca4bf13", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.167.106.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05812d49-b01e-48fe-952a-20c6d746d8ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.169.54.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6a2f8de-8081-412c-a218-5f18e73ba58e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.173.19.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5f50483-054a-4051-81aa-c0a4f8847ebf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.177.234.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0f17cb6-3b1a-40d2-a37d-3608dc83d6c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.181.60.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6903f0e0-b337-4a1b-bb30-29d1b8e59f85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.224.141.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3124df13-6d06-4183-be98-d8d3c43bb0b0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.225.217.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99a0b897-adda-44a7-bb5a-3fdadadbe751", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.225.5.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61cd7839-d46d-4967-9070-fadf6370b6bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.228.61.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9495a0f5-344b-4481-a2f2-42cf19f696ab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.248.83.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7d3b7d1-95ba-4c58-8449-2dc6c0cb800d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.29.184.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c444863-8022-418d-bcbf-0e38478a8458", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.49.143.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e69781a-f6e8-449e-b352-1986d8bdef4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.96.237.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a76ddfb0-bdd1-4f4d-91ce-f7a62bce4322", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.177.214.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0008517f-e8b2-4560-9d59-d4d004a01a8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.210.15.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3029beab-a298-4087-9c4e-24c38e61cb17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.233.190.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e03637-3331-40d6-8bab-93ecf935d50d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.94.94.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5da981a8-d1d9-47e1-8443-a5b62a880ba9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.95.34.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ffb7ab3-ef02-4c2e-96ff-cf7e45597819", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.11.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5391f54f-e2a2-4789-83d1-d3cdb13bbea7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.9.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d7232ae-6184-4223-8a22-99ba8d860391", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.101.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94a7b501-b86e-4a4a-90ad-ac888dabf64c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.179.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--514820e3-008c-429e-81a5-e62aabb82722", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.224.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--470fb181-9934-461f-b6ea-72f3c5566c1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.28.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--410d3762-3479-4c65-a682-6886eb047ca2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.44.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7faa44f-63a0-44ba-8e44-1eb85a82ce5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.5.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad4f7b36-eda5-4fd0-b510-ab6d4e2aeec1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.161.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1474c08-1901-49b0-9ecd-bd88e468bbb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.183.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f92fd3b-1b9f-4b97-a64a-f5189e1040c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.222.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--412eefa5-f1c2-45c8-bb5e-31c1a57c181d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.222.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d948d688-5038-40d2-b9ee-8f70d62a830b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.254.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7af60fb7-fffe-475e-9bcb-68627bc86dd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.101.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e8b6a74-7ec9-4686-8881-276a965cf6bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.117.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6af899c-b106-40db-b0c8-6bdb5dc5a866", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.130.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6af26d69-3cbf-4cc7-987d-7906a1365bee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.138.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fac6884f-5d47-4f78-b96f-b8e4817f4d01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.180.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6e551ff-76cf-43ee-81d7-7bd3f2c81aa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.185.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e23a990c-24c7-42fa-9632-d8b65a4b7662", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.191.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3b1f2e0-6364-42d7-bff5-ef04c1ec27f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.47.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bb0e82c-e02c-466b-a2ad-f76fb60133b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.0.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04647bac-a88e-4384-8ea4-2c54acea5eb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.0.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f85e0ddd-e24d-4974-b41c-1949f5892375", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a43c7156-f115-4fab-948c-94a079350c76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad2bf645-657e-492e-b21f-b61ec72adc06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82b7e9ab-e5bc-400a-b2aa-6c635b64e8b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--710459a8-f4ee-4535-8092-6e5b92c929b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42ed77e4-3b32-4568-a696-613cfe1e769d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e89b8d63-3d6c-4a33-b73c-4c11258ee565", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c6e8f43-f9f1-4267-8ca2-534d61bfa614", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--723c9d80-436a-46b0-8bf4-c6ee1fc708be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba91c71d-58bd-4dce-9e8a-b8f4d2dc7847", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--819dcf3c-614c-48d5-9722-9e1bb051ffc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--625e9b00-ed55-4a5c-9c76-13677a842b7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a8071ae-8752-43f3-85a8-4c429d0b2f24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b7515d8-791c-44af-a72b-3c940618900c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d21178e4-a7e6-4bfd-9fd3-aa17fdd96253", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bdb70b8-5be2-4f82-8ab0-1e44bf126ecc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ed6d70e-82be-41e5-8a41-06f6aca54ed1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c64e235c-1642-446f-8780-6fa04f6bbd59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.173.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68f8cff4-c084-4d08-a596-df004b1c7c07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.173.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b41841c3-9885-4144-831e-3785d9221052", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.172.116.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf3950c0-2aeb-4086-ab94-dd339ab24d06", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.2.91.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c6a544d-56f1-418d-8da1-0c90af35b872", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.202.82.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffa2823f-864d-41cb-97ed-13f60de7774d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.6.131.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78af8b9d-6862-4826-8c60-d60912e0e95a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.129.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07717946-e12c-4375-bf5e-658615b4fa5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.135.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ec32dc0-9f88-4ffe-82b2-26497bd00927", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.145.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8b3dd5d-9056-42b6-b833-b3fecef104ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.222.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aecc19f8-d618-467a-adbb-c20310dfffc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.234.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b156453-0361-4d3b-81b0-df893311d032", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.246.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc686875-ed08-42fc-a145-44107e776897", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.253.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cbd3c60-56c4-4c16-86df-bdc08a1f5b73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.29.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--463080f1-f9cf-49fe-90f9-90001d38ebcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.29.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b35f3d-715e-4b3b-86d3-1c61a4b40c7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.35.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2464a62-1b98-4a9a-a74e-5e5dedd81147", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.57.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32e0d7b9-962a-47dc-8ca9-8b27055c8100", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.56.199.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12b3803c-8e6e-493c-86e1-d87247a5796a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.56.229.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--749343a7-ef5b-4c01-81ec-7dcbea8141f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.59.229.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e65bff8-8c41-44c2-9f1a-9041301beb38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3a722b2-21dd-415c-9d43-176749f6a497", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--779c82e0-3194-4b54-b0c8-d6f2397d6dd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abcbd846-d44e-41fa-af58-26b1d53ac2ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.139.136.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8865a40d-2766-4f3a-b9e3-7de4bd8672e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.154.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b04ee34c-43bb-45fd-a3d2-1cee304d7f9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.181.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7f38595-b9c0-4b9b-ae77-9193a6475062", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1704e779-222d-4abd-8b8c-af32a06eab70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f8747aa-5d63-480b-b705-a9d4206d2a9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecb4054-fb47-46c7-ad19-b46ed4ef52b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19edaa79-30c4-40e1-bd24-d47619930ed4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c561d417-6aec-48c2-a2be-3ac6cdf2cf45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b76bed4-de67-4bcd-be96-7229df0c44a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2efa881-46b0-4328-b585-675b40389356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eec60342-d10c-4cc1-a871-17a2a0368f3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49544427-2761-4b8d-9134-0718fdedf93c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57f6f968-bb72-4f61-bd8b-34bddfc01b6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--321a8c02-e649-4a1b-b7d2-60d271b6eef8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec278eab-9b2c-4f74-a2ee-09eedd92815a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59981371-104c-45a1-b0a5-6ff978731b0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d4ba1d9-9299-4193-b6de-d96b7c8c6fef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dd97082-1ee6-4086-9be9-a32a73debf18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f576868-e117-4019-8a56-11d4c103a5e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40835e23-eb90-48bd-9d35-850fbba181ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c9641e3-8eee-4886-8ca4-3eb0822a0d9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f7e7b20-fa60-4a6a-9ea5-73a77ad0f436", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--521625ec-fbc0-474e-92ce-907974976c02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--019884fa-7569-4168-b25b-7a8a5a8718c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9ad8b1d-0db8-403b-8e7f-7ff12bdb3fdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36ac1887-b51c-4cbc-b984-a20dd0234b42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04f97cbf-c826-4f6b-b2ab-ad919628611d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86c425c6-b4fa-4885-8dcf-ee6c7837cf52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6598aef6-3cb8-4281-b0e6-b5c81b960c4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad5c44dc-5fe3-4654-9743-349973c0efec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b45b811-15fa-4bbe-8d32-a8b44fed7acf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acb088e9-b4f2-455c-b215-ff427bfe5fa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f07dd6c9-886d-4e18-9588-e8c1b7813576", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a280be-d0ad-430a-a5a5-6ba9a98f7334", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecd9252f-0d07-49e6-aeef-d282885fbd54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd5d6cbe-6774-4608-b9a2-42307247653f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42970bd9-02d7-4d7d-8c1f-7597f2606be4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fc5c3b7-314d-49b2-bbab-52aba3dcdab7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--503f68fa-fc22-4344-a993-5627118a5a17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbc8792d-64ce-4ba5-8a11-bf19c9d69505", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec72973a-fe29-4d6e-853a-8e509005bc66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45c8a819-a177-4db8-acbe-63495346fa34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84d707f0-344a-40fb-8116-19b6fa3834d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f30f9ca3-c0ab-4418-92ef-8bb05e7e0e95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b565a3ef-f17e-4a67-ae45-a55735b7f069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e446f2cc-edf4-4cab-9100-a80787434ea7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34b1c849-5e6f-4dff-bfe4-7ec023dfaf50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--393f1bea-998a-4110-8fb5-4b2a8f078c69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--649aa5e7-0cc2-49bd-a388-020d689e2443", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d99f490b-c516-4bc8-be94-12cf11d32381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad45235d-664b-4fe9-84d7-ff5d6c7868a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af8b9bb5-679d-4961-89c0-b2e2b5dcebc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e0addc2-2124-4d30-9e46-b12b32e32831", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--548c48c4-d12a-4815-9d98-0f6461e5205f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d68cc52-65e4-4de3-a5af-45ba1f47767f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d26395a-4ab8-44fa-975e-ed3dd8bcb0f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3bfbbcd-df42-4045-a3f9-e0881ea4ad4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7156dfaf-7ceb-411b-a635-44545b37f945", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc3d2e81-c645-492c-9f20-6c64aff7a202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--658de206-377b-430c-a004-3cdc1a1ceb33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4ac276a-e020-478a-a06d-170306e69f59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e669061-21f4-4a23-ad3d-213bb1a9acef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca1c326f-d65a-4953-b798-0b6b4406f033", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90c2a48e-16b7-4015-8c49-2e26b546f3e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d9d7247-bf8f-492c-a433-13c014ab2017", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8691e6a-2c9d-42fb-97ac-fd4c65804b1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4beac2a4-2bbd-4ff4-86a4-5b43e52e0050", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b14dd018-f440-4649-9c5d-30e743422b38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d432f13b-9ed1-49cc-8cd7-bdf76518f340", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e9df4ec-71f7-4aa4-89c9-f04876d4d43e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4322baea-ad13-4d63-826f-79e0e3333be1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04de3c7c-7b81-40fb-bee0-d7d6a3760086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85faa33f-5dfe-46ad-91e0-6f3800a93bbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59f314dd-3aed-47fc-a22d-46a9d9b1f37d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dfc3136-0e6e-438e-88d1-0b27543dc075", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d724020-1ce6-4609-b152-3a660661fdf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86db9c10-c809-4534-8c2f-928ca3b8ee11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e3b6837-a344-4fb5-b07e-1256334ddf41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35479cd4-52d8-4727-a3a8-b71e67b8d425", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4492bbed-450c-4feb-84b8-7ca99f993791", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a78c8ef8-79ac-43f9-b0b4-a1315d36c4ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2586e781-d09d-4b52-be74-41197e0a45fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e23a4a5-5495-4969-98d0-408bd4d0ad17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--775c1e4f-41ff-4d38-a65d-8631fdbf03aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cb7a261-b7a1-4d0c-a487-43e81c8dc765", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ff141a3-889f-4300-ab85-42867a099f0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8421c6af-3dfb-46ed-a39e-8a60c04d9598", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dfc25d5-f415-4657-b7ed-dc3a3896ca3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57c45d4d-ca5e-4a0a-96d2-bebc4f70daa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b98da7c-12b2-4c32-a93a-df1a278e8f57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a8da619-dfd3-4ff0-826c-4999e5f85bd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b7cc23b-a533-47c7-bce2-147da82e917a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2301066f-75fc-43d4-8c72-3f97367c8b83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95a2e9de-7585-4c26-a385-02a9e05e9e65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79777d2d-f4e7-4db2-addd-4a73a3b8889b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25e5ae26-c59f-470a-a5b5-f39b30d84ca1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4be2f2e-9bf8-4ae1-bcf3-3e3ba2a84a57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7822d9ca-7f86-41cc-b403-32e4b33df29c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69db0f42-3401-49ef-a0fc-85ce668c88aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--929b7447-1c4d-458b-9926-0a9f1a40e931", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c93f17c1-5e78-4d58-818d-3e42dd9c8c58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75767092-e23e-4968-8124-4ec97789c9b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c2da1d2-aa6e-47bc-a027-56263f42d47c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2af883b-1106-404a-88fd-9563f108eef7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c35b6625-3846-4c79-8cbb-4af9a2fa9590", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29d4f281-d64a-41a3-97d9-f60e3c2aa457", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--589eaa21-05e2-4eb8-b326-76ec7b6ce6d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f512a55-b45f-43a5-996e-62de01596d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bcef634-e6fd-4ad1-9f58-9d69eed96370", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8235eedf-895b-48b4-947d-f3452a7241c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa556c4b-938a-461c-a7dc-db29c55dbd5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ee8261a-3b8a-4591-bef7-337c633354bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e54b7cea-421e-4d90-90c1-99e75842833a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e62882ec-bbdd-4388-87bc-d013b86bd727", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d630f76-f083-40b8-a775-c8333d1dcaac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ca840eb-139f-42d6-b20c-d9ebadcc3c95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e501ba3d-9426-4173-a42e-79251894bc8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87e9345a-ccd6-4579-8f12-de1f79884299", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b912a984-9ac4-4257-ba76-58bc351e95ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b527043a-41ca-42ce-be8a-ee0646efbdaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fb1cbbe-ada8-493d-a042-7daa006fe51b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29d8b4c3-4fef-43a6-af55-b279c29fdc76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--084bddcf-6fab-4c88-820c-48b92f5f1a8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afdbeca8-7577-464f-a770-a711f04a66a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.0']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e166ee88-f715-4b8f-9352-99783b01f073", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1ccf872-d2f1-4e3c-bb17-5c0b3da89000", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebe35768-3490-4a9f-827c-cda53a5b6d66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27592e73-1bef-4216-9b8c-7724f7e87537", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85cde4a9-fedb-474a-93dc-33bdedee0f92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6946bd2-734d-412a-b638-32a1130427f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--614d69ca-582c-42f7-8a0f-55aad0bce651", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a2c0b16-3d4e-430a-b2ee-7604b0ef3fd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87395e56-9e0d-42c4-9f20-a2a701bb2a14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e46c046-7263-4674-b446-fac58f471365", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a4a2335-5809-4080-95b6-ee2c67ae78da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95434279-d5b5-41cd-9cef-e64c7af726f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c683637c-78a1-4816-a03e-59f2430b0e9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef258e72-07fb-4792-a925-e5e87ec9be68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eacb36d4-dee2-4e07-b567-cfbbabdee203", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fee434b-6c56-43c3-9531-9de513d179d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c41ee4b-c2d0-4df8-ad8e-7c31fb3e5f3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--774ea8b0-28a7-4405-aa67-2543439e5015", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6050741-df20-40cc-95c8-d5a17adffaf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--635745ad-b589-4cfe-bf96-7f3058486cad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d604a906-578b-43e6-9df2-e9b98f26710f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6cf0f65-afa3-4387-8f0d-8213f839000f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4859964c-b900-4688-8771-d1fb1e09f940", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ada3d651-f6b0-4939-a507-93f01bb4789b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--820ae2b6-46aa-4a67-a645-dcee7434ae90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4c9beaf-e3b4-4a1a-b5de-2d2819c33caa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83baed44-0b45-4dbb-b647-3552f12a89cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfae7990-a5a3-4188-99dc-e82b9fb5ccce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab89919-e87a-4710-bc3f-aa318c3fd990", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88760db6-aeba-4958-9655-6d68da887b7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ca337e9-4820-460e-88a1-6d0c26090820", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52086a87-30b3-457e-9d33-253f5b9dcf10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23e6e2b3-71a6-4fb9-9613-3b6b1c266fa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1772269f-b205-48e2-ac91-71051fb11497", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2c78012-a968-471f-8a0e-af950df1af95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1707c4a5-e55d-44f9-ab90-5f4bbe238ae0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bca466c9-1226-4f91-b158-b536b101a170", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87171159-ecbd-439b-9159-01bf55ff5009", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9726d84-e59a-4887-bfd8-f1ed50623212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d3dddfe-0669-4771-8d54-aa725f824266", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24e836f1-b7cc-4425-86b0-4721120c49d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8a7b01b-93c5-4128-ae62-35dd365c517c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a58c9bf3-277a-4c98-bb09-27bdf51b3e17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd95b695-f3a9-47eb-a2ba-49265f96ce24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82c1c906-2d42-4ec0-987a-17a1366cba80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee7632aa-0aea-409c-8603-01e8b24361a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--963b91d7-4e7c-4150-a05a-01776539c8a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c158a67-461f-41ab-a3df-9b785b5b9e40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbbc6385-84ec-490e-afc1-0141e28bca31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8246c98-39ef-4ec8-bbaa-d4e80db6bc90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a360aa2-5bf4-4577-93bc-9d3218238486", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0b86c53-205a-49c3-a291-0961ab5a929a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06d580f5-53fe-493a-9fb3-cd6ab73e06d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a8b96eb-1a7b-4187-ab39-09ccaa998c99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b34a88b-4d47-42c7-a35c-7ca571ca0d51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ecc62ba-fc7a-4645-9dfb-323c3a72d189", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--872459f3-4126-44a3-8a9c-a66fce48d381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb4e73c7-329d-4708-be3b-47163f761b01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdddcc90-0bb2-49d6-8bca-2290811cc019", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f074da32-9858-47ac-9cb5-6a1bbc515433", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb39f82d-bd88-4bdf-b575-277e194d8134", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d860fcf3-7037-41ec-8ccc-f2b65c8d1f69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c8c0fd7-fa2f-414d-b0ff-e27d869b47d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cadbb16-2e15-486d-b1d1-44ee1072f831", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3a2c853-73de-41e8-a654-89992aba51cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b659ee31-7b5b-4d36-983c-342ddde68448", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffed2da5-6fdb-49f3-ab0f-31ad751def2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22adc4aa-dfc0-495e-925c-ac740d888396", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0fc5cb6-88ce-49ff-b83d-b6eb1b6e0d25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb33831d-0c09-4bf9-a679-de4f13ed07d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bc46726-d8ab-4714-bbca-53e1235ec22b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80bf1c30-c070-4bcd-8f7c-1d8b7e39087b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77fb42fe-0ae4-4e20-ad83-0adff41fb808", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb2383ba-e690-4be3-aa16-3b7aabe866b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90de35aa-0630-442e-9e04-9657498b5859", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--675cd72b-a975-4694-bd01-e150d7e0c0fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57a64b1e-1340-4869-a554-cdde3136199d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f191e35-2379-4cd0-8a92-3480123b6e71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ea2328b-a20b-4261-8b76-769efb3d0814", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0082a7e9-0153-4a2d-b161-dce1f3eb85fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--225480a8-0d61-45c9-89b0-dcffdeeb9b67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d70be00-f169-4575-9263-f18ca9764f3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca795f60-d065-4336-88ea-7b2aa1b4f185", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ef9402e-28dd-4450-aaea-57f66e00ede0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87ad2c72-fa42-471e-866c-52f313cff258", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebd111d9-f5eb-4d1a-a0c6-886e94c92ba5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9812a8d6-9342-4e86-a14f-b76a3f336510", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9701cfab-ffd0-4a02-bfa8-bcb0fd691333", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--147c7d5c-c9dc-4eb5-8fe0-34652794e51b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e34fa316-45a4-486a-8c8e-f222b8b99657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--938bd0bd-9979-42f7-9497-00a6b325d992", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccc095de-94d3-4999-8799-61858886522d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3428d6d4-dfab-4aab-b374-e21613e48335", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a89d9d03-74ae-48d4-98a5-1ebbae6c6ea2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2ac6b38-802b-4426-b563-30427c03b28f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ccb1377-dd1c-4225-9f61-658e19e987d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ba70e57-e102-4a99-9c49-e45c9d7eeaa1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3d759e2-93dd-4c59-99db-ebcbe58ac36e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48da8a02-7cab-4e51-8aa0-e3e213d3c45f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8f28b72-ec92-40cf-8cd1-e720a3e989ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--646ef146-eb94-4320-830a-9c8ee5636eb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b0a4e12-e29b-48e6-9549-0fedf908d62b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c60560ce-428b-49db-8c5f-9d5ce1190372", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--598b0a46-da89-401a-8899-488f6e7be36e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a50b3e-6bff-4e05-b175-79ae2d775720", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e66d52f2-f9f2-4a61-9f21-3b5bab670780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd8c1f69-86b6-4b86-b30d-39eba3f71452", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c82c9dd3-04a6-4a0b-a309-bc8531085cf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b669eacc-825c-4179-8179-9f4579218eb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--449d5557-ace1-415e-ab64-7424752bcb56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec417707-82c2-453b-93ce-48cc442be74b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--137ecc85-b248-4123-a56a-c85872dab76b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dec6c0d5-ae44-4104-bc58-3442f809ec4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb069794-cf4a-4cbb-9ed5-d6080e9b9bc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5512c00b-32d6-477d-a430-51356363d525", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfb8a1d2-2ab3-487b-99d7-6e4927278f13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05d70252-46c4-4cc8-b26a-5e7bdc29768d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44938098-e9ce-41e7-b7fd-710feedfb1f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e1b2f32-db6a-47a2-9031-a01b211482e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--667a6f6c-448d-4917-bd85-d524b2970fa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee480c64-0bf0-4409-8eca-f4db7b3907e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30177fd3-25cd-438b-b2c7-4ce580ea1e6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d6e8bda-8c98-452f-9207-858acd738387", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--653d8ce8-049f-4a19-ab27-5772e48e334a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b7b1f1c-bea8-4259-a3bd-b948aa8c22e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f2be817-04ad-4dfa-aad1-9f471b5b2c9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10f30546-4675-4d9a-9d26-0c5776f4ef9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--102d72da-914d-4f02-b90f-3c3c3997078d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b95eb76e-0773-4b4f-8e2e-afae2b45f7c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be6bf779-a6b5-4c8e-be2c-03455bd6aa46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff0e1944-aa4e-4d92-985b-890b27fe9b30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf600e74-9fb8-4871-af34-7c456931869a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80512d55-e587-42cf-a49e-d75301cf6a5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--963f93e9-119e-4909-b6dd-b7e7309673d3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.45.48.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--355a9a0b-5053-41b9-97be-916e54511bdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.113.201.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcb45c2b-ed26-4a7e-9da4-25831a957e27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.121.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--263947d7-7321-49d8-9417-2f25a1fe4893", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.121.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b47c3927-c78a-4334-bb84-a5cf067ecea2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.188.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21510c93-f741-4ec9-bbd9-6799761bbac2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.188.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c53bd1d5-d310-4e4f-9625-432d4bdc3c9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.56.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cea2ee1a-fde0-43c0-8362-9cfeaae205a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.253.35.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--861a3099-b81a-4874-8efd-24406cf22407", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.50.220.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--010b4da7-3de3-41a0-bf45-2001d46f324e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.56.85.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb3399a4-d8e9-4fe8-9b03-2a47021e3631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.157.122.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d87591b6-a0af-4d84-bd2c-aff1333fd943", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.133.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b953ac63-3043-4915-98a4-a0f59506f8f1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.156.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20416d79-f56d-4776-abea-206ec822e8b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecc59591-6f33-4076-8aef-6f570cec3955", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd8b193e-315a-481b-8815-2a6c7870fc26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d66468a0-fde1-4dd8-a316-5fc9eb246588", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7289aa6-ac93-479a-8904-17222384b526", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2ab6225-b608-48f3-80bf-bd5639e2b87a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34a12ca8-1308-4bc7-8201-e3e77a36a482", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b0c6d2a-fe0d-49c6-bee7-430c43b2ab19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bf7314b-eff2-46ef-9098-e2aa480610c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2efec8b9-ced9-4a1d-8ca2-94e3e9393438", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30489283-81d7-4687-9b74-742cebc61ff5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54f4f22a-d865-4ef1-a256-fd747c1630b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97968d81-1431-4113-95ec-f7d246559a89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9c5a5e8-3e78-4227-a67a-45f8989eb4fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b3fa43e-9d8a-4d63-8ac4-ea4fe049860e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a182a89a-4dd1-4cee-b799-a801ee21a8e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--865562bd-0dd7-489c-a94a-1ccbef99a98f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf81e0b9-9e64-4c25-82ef-eb03e56a5f72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db2a4731-e81b-4283-b12f-89d0a6e46725", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1e1f970-d72c-41b4-b5ad-0651209a34e3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.116.176.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0fe73f7-4274-4fb5-b8f4-dd1f9d1db356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.158.32.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2351284-424e-4531-8ae8-dc916d70effa", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.131.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3510dd33-6ccf-4621-8a01-eeb52c6de800", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.236.7.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64484ac5-1272-4d78-8122-0296b882f8e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.237.79.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4360142-f561-469d-b192-bc1a8534bda1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.242.191.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62f2a429-4338-412f-a6bc-8196e3222481", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.172.100.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c56f6cc-3fc1-4409-9e17-f4ddcb425fb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--088567f9-2fd3-48ae-a042-51385244fbea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7045c6ea-69dc-4253-98b5-d6ded2508ebe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1570880-25e4-44ad-a3d6-763bc314eb2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.129.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--217f0cbb-af15-4da6-92de-2efdd39fbdb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.130.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81859e8e-b1e5-448e-96db-32e85499b0be", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.132.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0158af09-4daa-4474-aff5-26d91dcfc4ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.133.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b2d2d81-429a-427c-b20d-c28eae655b4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.134.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8602206-ba7b-4cb7-8478-31e963784a71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.135.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c1ad494-e68c-43b4-9675-56b4a7b6731b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.135.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--722380d2-41e7-4818-9fda-b6409597c557", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.139.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2e586ac-bd95-4e36-b38e-26355e296ec0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1aa8a087-bfbe-4d07-bda2-5c6dad885521", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca468f21-1e65-4af5-b78b-8ec52ced6d9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98658c12-4507-43c3-9cf1-676ed5330998", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bccc50f2-0e9b-4a4a-8672-ff5b2e87903b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2535907a-5265-47e9-985c-76d2d054d16f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--705483c1-0651-4046-801c-3b6d44638c76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df82397e-6ab4-49b5-b770-d4c540504964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf519184-8589-4aa7-bf65-4b2dea361f38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61513a74-9dbc-4d41-9c31-c4f26bde90bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3610e5c-e528-40fb-87b1-b3e954bd7d8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a67e1890-564e-4b59-835a-4eeff3e18129", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.142.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a5acd1f-16fe-4eaf-a110-721186efa42c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.142.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8100d24-fdd2-4395-9a7e-834127b7512a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.143.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36a7f797-916b-447f-90ed-7cc53eb3fbea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.146.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2fcb746-ebbf-4129-96ee-ce4e71ef2cca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.147.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3137e519-d4b2-48a7-9c8f-49992ac1921d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.148.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--071d5582-3c55-4bfd-8fa7-020ca42383f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.148.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d64fbc2-f75f-46d1-83e9-71bde2bdd962", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--489a6dc2-f694-4f8a-9b0b-12ba163c9719", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4feff76-3460-40fd-b7aa-b2e6bc00f5d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--def73609-42f4-4f33-9764-af9eb380b8e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.150.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a60aec5c-8168-42d1-bd75-8fb42ffb1bdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.150.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f8ce51f-f3b1-4d75-bbfa-05e7587e9172", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.151.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad44bbc0-6fae-4cb0-a02c-e90d322586f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.151.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b39be8bc-aa38-4056-a5bd-76b3dc451cf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0f96548-6239-4eaf-88f7-a5ce22f05754", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb53e0a9-00a9-45e3-8f85-e65a8b954e2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89b96be8-8ed9-4e9e-92bf-d67005f923ed", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22977677-ed2f-44ba-a5cf-8a2ea5d16045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.157.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5a30787-15e0-4119-89a4-269098768e85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.157.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a7535ad-14d8-4a8a-a75f-0676b35e8a62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.158.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdde7037-d770-450c-8646-c13a94de09f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.159.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cf66b36-9896-4f71-83d3-e6f2fb461afd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.159.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a2bc2b5-5b83-417f-a8a4-f611064d35c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.169.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--176c26d3-e9ae-4390-986a-f1f5ee2d699f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.170.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--726c5add-aa8d-4b0e-9cb0-969b6d4ad5b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.171.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92a6df27-ad39-4cc7-9c85-e0691454bb59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.181.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7e2ad0d-dd0c-4f33-988f-13fb8cda3c1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--561f97f7-34a9-47ae-aa29-4ab07990ab92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d8581dc-8fa8-4e4b-849b-214fbc7c1674", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--817fffc8-5606-46b9-9823-514dc732bd67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.186.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--434e8082-73ab-472f-b935-6599c8a78a56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.188.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3baf8bce-baf6-4f76-a9d3-e8c1c9a1a5e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.191.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f7c6c3d-00c7-432b-876e-916013401376", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.197.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efc74991-46d5-4038-9ac5-a358576327d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.197.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bff7b1d-4226-40d2-9e9e-e584c51a3976", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.198.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bc956c2-a6aa-4675-a396-328dca4cd09a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.198.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd32c006-a4d5-492c-8197-3d944dd5d57a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.198.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d39b426b-c44d-409a-aa62-b0fc4306389e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.199.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e182384-4ce5-48f6-9efa-f8a75a283a61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.199.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00dee9f5-31c1-48aa-9c95-4445ad9d90c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.199.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5273a7bb-aba9-4b15-8f83-c35408e6c554", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81de90bc-dd0d-48f3-9ccf-9ca421b2a1b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--550c8166-1c91-4b6c-8e11-fd9fda2c5692", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a451d2d3-9dbc-4ede-acd8-b77ee8c1c9d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f428b64-f8ee-4429-9d5c-da73e33db777", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a29dd5b1-d833-45d6-9a33-81ac4bc7af82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd94008c-dea3-45c4-9c72-850f5d0c0a8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6383d957-f466-4442-b0f9-554128ca2b9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4612e760-be32-4e5d-8eab-7bae4c95e8df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.203.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92ec260c-8504-45c6-b733-c0666bfc504f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ecfd8a6-dc19-4a4a-b361-0e7feab67aca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--923cd9d7-4001-44f8-bcd5-1d0f0c63ecbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca867764-9268-4815-be48-5e1365f9156b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7925fec-8d00-4b4d-95ca-11d4d4da2e63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae029c23-979d-437d-a289-55d8513f237f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ead6d0d7-e1ca-4f72-9cd2-639f110128ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff388557-7d5b-4375-a68f-63a96e3fe7aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f42d7447-44c0-4d29-8caf-4b8678137331", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--455960e2-0461-45f4-90cb-f2318db27779", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fc49f41-d998-4174-9633-dc66b7ef76b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bde50a68-8132-4589-9e1c-2333b69317ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.208.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d20a8296-c902-478d-b0a6-22007f8d1cfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.208.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abf516cb-2157-4f1b-b739-5739eb3f239e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.212.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e74b5665-dcc3-4165-a001-6b53fd3d5a98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.212.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12964e81-67be-44f6-8853-27397fad04e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.213.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af2c70c4-48b2-4c05-9566-303a896a8075", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48bb9289-3d98-4d53-8e0d-83dce5ddde03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef7e2639-2219-4817-bbba-8d8c98a80e7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.216.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eeff4cc-68be-41a2-b674-37713e2508d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.217.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26576091-6a8d-4000-8fe2-0964887a7bf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.218.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f90f8dd8-0051-4eb4-a1cd-893a1b782c04", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.220.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b183c93b-b3fa-4c0f-94c7-ed0535fab5f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.223.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53c99ee5-2e45-4bb5-bfad-a04f367238f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.225.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7b118a0-358c-4e9f-bbd3-3938cd9c78e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.226.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19e7e410-cd82-4187-89fb-a735a153a771", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.226.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa8a0b73-1c0a-47c9-9b28-87a31b763362", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.227.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a14b813-26eb-4df0-8b10-9e8a7150a1f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eabc4a46-1590-459a-b1cd-d1eb122b92f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71edea2a-6ece-40ff-9dae-d3bbccf526bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f898f25-5edb-4003-8b4f-05cec36ceda6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6a43dfb-556c-43c2-8ad9-40eb4b90fe1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cca5ab1f-e826-4ef8-a731-fe0fb5c962ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dc17b5f-4000-46a7-b56c-e19a2f5aa634", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fee9af82-320f-4915-a27e-4af43d02da7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--279fd634-b259-403c-8ce9-b4472f09fe96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fb2474d-3091-48de-a7fb-51afa21644bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8abf55aa-b473-41ee-83c4-a022b1cf4aff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27228b9f-7d15-4595-a12b-6fe52194d634", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be4fa1d5-c26e-415f-9fcb-51533982ae2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6db4d7f-a4bf-4184-a5f6-bb5a6c42ae64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9edf51ca-4155-4591-8972-794ca6d62243", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddbe0ac9-eed7-4fc3-94c0-465620266f47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.247.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42435954-eabb-4a5a-a02d-38ec8bd2bfd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.247.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc16635-ccb3-46be-ba53-5b57a9ca0513", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.252.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b3e16e2-86cf-4d6f-bb32-2b1d941b5e5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.228.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acbae8d5-6ad7-4024-9a0f-c0374324174d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.191.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac844ddf-1baf-424c-9384-3ddfbb63ca71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.22.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fb5d49b-0f44-4fc3-bab9-15243a504a19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.3.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecc220a1-cfab-4ea9-8563-105d667fd8cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.81.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4210d72e-496b-4d0d-a312-5348626d0c7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.34.120.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebcc3e44-4cf9-4ec2-be24-29e49f76269f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.80.240.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c521c00-3060-4847-b1ef-05111708ceef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.0.30.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56ca1747-6ed7-47a3-b816-79df59352045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.115.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8ef504b-68a8-4f01-96e9-f84add18fbdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.146.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc98a896-f123-40c9-abc5-f649ed52107a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.180.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fbb7d8a-94aa-45a3-a9a3-c9760b88e005", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3a531ac-bf8b-4d95-960b-94a7e3e465bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ff4a11c-91d6-44e2-9f76-5d5327adf856", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--096911f1-0af2-492e-8d8d-1e034ccb680a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caf69d0d-17c8-498b-9ed6-f95f870bd16e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53aa2deb-805d-45c3-812e-3e160b3334d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30cd713e-1e56-437e-9b68-12cb6f16ac5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f860ff1c-8c7d-47e1-8c8a-00f98e95a85f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.16.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c66cf41-4a33-4de6-84b6-e4ab86f8b7f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc8ea5ac-d614-4086-8448-6def0f04c690", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9af2049b-baec-43e4-9a87-6b8575708bd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d201f91-6eaa-4567-8071-c5d2250635ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2762f83f-aedf-49c4-9db6-80bb98b0b5f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef21dfdb-10f6-4d06-aec8-a71490eed430", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca38aefa-713c-4922-aced-e5ff367bfbfb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9f206f2-9b98-4ae0-9a05-05fc5b7c763a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd3013b5-cf60-42a3-a42a-aab780485e88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea0afed3-bce9-45e2-ab7c-fabaf3fc5377", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c7686b-2a67-42c1-9af4-f67b94c1d7c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e59cf9e-abd1-4ada-acac-f398c883713b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--521716a6-0d4e-43a6-8d83-d82b5d08ec50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aed9ee32-1b12-4221-a3fe-ffe1004edbbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12b8ec38-54c1-4d32-900e-908ca49ad5fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a67c38f2-db7f-46c7-9a59-93f0bf7f1bcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdb298f4-2515-48a1-878e-ebaf31955057", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8c61b54-549c-46c3-8d3f-94c904f0d864", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a53b63d2-edbd-4b57-8f29-833994238945", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ac15293-cf2f-4739-8bf7-e9893a0969b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--121fb68d-33ca-4862-8bdb-538bbb38dd9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '155.94.145.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70f723cb-1fac-431c-ab4f-913129aa1644", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.239.253.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da968464-5a1c-47c0-aa1a-ed4dc6493f02", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.15.40.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34d3c563-bc8e-4798-92fe-a237ba1c5278", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.104.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d8d301-77da-4384-b6ca-47a21a68565e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.112.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d86dc474-43bf-467f-a218-c038e5731b90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.154.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7331cb52-aca7-4f72-88fc-aa414fdd1f2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.161.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e68bea7-2c53-4dfc-9305-507533ee9ce2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.234.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5aa6909-f1a0-4f1f-8c49-df73d523f353", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.236.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7bdf232-002e-4aa0-b2c3-409e26bd5098", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.4.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5f83849-8f3c-4ffc-bd53-2de43449a6e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.243.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82115191-6d6c-4e69-9010-84511e5e8720", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.4.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2591ee71-7916-45e3-8eba-f6f397f674f1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.66.81.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--443414a4-4219-4372-911c-ce35a1af548f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.12.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07e15776-d3a0-4e0c-8f61-464e5a7e1611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.124.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda847a3-dbad-45d4-b716-cd1fb8f23983", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.43.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--891a5d3a-3adf-452d-bb1a-0e17fe379089", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.179.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0792d998-d51e-4371-ad77-b51ab6c31fe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.210.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--618f8cf5-d5e0-4a62-a62e-45f07da42c3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.253.120.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b01c417-75b3-460b-992b-abd80f500bd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.168.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10c79d13-2c92-4915-a6eb-432451683959", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.191.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb306458-7c6f-4d8a-8934-db2de8b8bed0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.219.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b23d1c1-26ad-4c0e-a870-04407074fa4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.32.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fae57a9-7eba-4ac2-9bab-d2fc2fed3afb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.6.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4c081b6-535b-4c54-9bb4-d6d719db234d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.113.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80361176-bf38-4115-abfd-ebd77dc1e0bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.47.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5b579f5-00ef-4588-9f6a-6ff7d302727a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '16.176.125.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c26efdcf-9223-42e0-90af-943bdd24dc9c", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '16.59.123.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e6353f5-3f99-4ef2-9cd8-6f2295684c21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.69.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e38f7265-306f-42e2-a6fc-ceed1fca4d90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.71.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d13f2af7-e690-419e-92d5-09e2321df0c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c31b136-0893-49b7-9009-37ed9277ed7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.238.24.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c75d01d-8c33-441f-93ed-1e7d5cc16997", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.30.113.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b68e524-c3f5-4385-8df5-eac953978dee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.30.142.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c91edf2c-3b91-410c-8bd5-e04eed229dfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.10.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e00b2e05-dce9-4aff-82d7-8c914f8675f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.111.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3d3c5c3-1209-4d94-8421-a77f81a580d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.190.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d772cd61-1cd2-41cb-8e85-d2de83c25b74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.230.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62c7e648-dbd6-4ebd-8ec0-5480ccf45557", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.231.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83e10c87-0275-42ad-8d49-196a992c58b3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.65.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd44d6d1-fdfb-4cb8-8c86-6a54dd95a65b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.14.109.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc01be4e-a4b3-4946-b0cd-aa63aa0491a4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.14.81.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23e3bfdb-017d-499e-af43-926f6bb863c3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.19.243.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07268166-7f8b-4549-930a-5be7015fd342", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.214.98.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23758db2-668f-4368-bc2d-2360be182477", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d755c30-4852-4368-8cbf-3b11fadab651", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5470adc6-c489-4758-b7b3-ba0c05c92782", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4f8a4e0-0c4e-4840-864f-08a3638dc371", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef232348-2ce2-4e25-8a99-a4cde3b29130", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e51ba45a-63e7-4d3f-83c3-24c1aaa608cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f8bce97-8045-4088-bc87-3d962601d6fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e620f663-6869-414c-89be-b025400fca5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64616f3c-45c3-4be7-ac9b-2363dfee97c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--922257fd-164c-4e9f-abb0-1ba3d1b34f03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de4188e9-6145-439c-b3b8-589582d7a374", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--709b67d2-8979-444a-ad91-1da572088bdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4047add7-cdc0-4ed8-910a-1b0bee03ae2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9ddd489-b110-4599-be4e-e2cf83b8224b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35b7c652-fef2-42d6-8ffd-5b55c46411f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96365a04-6f73-4f5f-b312-a3e6e6140af0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42c4f03a-ed04-4ea3-986f-808d0a53f2e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4034665-08fa-49fc-9311-3b064bb6417f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--972ee51a-5ca1-434a-b603-aa4d48b4f4e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3532e09e-ffae-46cc-a52a-2f952079fdfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ed099a1-9993-4bd5-a47a-681684e4073c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57eea8c0-401e-48ca-a555-1184997c9ee6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0060875-e154-4b98-9d0b-1cff1664e906", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d61081ef-d614-4fd6-8688-988884018150", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acd21ce1-36d0-4cc9-90fd-704fd28d6abc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3faf9895-e02b-4cfd-853e-26c88d695436", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be4e3b58-5033-4b7b-989a-55deca5ba2ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4e59f4b-d5d1-42ea-85ec-5dca840514d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16f0cf29-9ec0-4754-a11b-44dedf8a4dc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c673417-afb3-4a59-a7ee-4eb09a2e0f05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5d4535a-7ebf-4423-9bf3-9e74804a81e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3df0fb9-70e3-4a93-9311-4208661d68d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e3f8bb4-ddfe-4134-a29f-b9ab807e6d74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5175de01-15dd-4aa8-9244-3e726a1e82be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b2e2666-724c-4562-bd6d-9ac60b39099f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9035f023-da9e-42eb-b9a6-dbec1d7e47d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea0e9370-f65f-4661-aae5-27e1e587b61d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a288d5bd-6190-4c98-8482-4cfd811777e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--749becf5-5378-4cf3-9523-f67145800726", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f78693d-aff5-4f1a-9142-a4d8d9d2eab4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f0ecb9a-da98-475b-b01f-44bd1deb29ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a27a043a-125f-4979-a9b1-5c8dc25ae2be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b474b7f3-d012-4c9d-b487-15ece57d6188", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcdbba45-5f96-4b59-8999-4c762d8c1506", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed540b1f-3700-4a83-8fb0-66774e6e417a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdd49aab-eed7-4832-8ade-e843e0dd6adc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8da3673-7319-4279-9605-fd8e8e3d0451", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee5607b8-8b74-43b8-bd03-ca1c5008e3ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5e9f636-9a92-40b6-8a36-fcd410046c1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db98d2a1-2acb-43b4-b766-dd95afdcf0f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77793272-abd4-4522-a5c5-2ee24212ffe8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97dc7099-506d-4305-889c-dfd7c6549666", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57513d19-4152-4bba-b9be-94c5cd818347", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1b9dc40-7f92-4b0b-864e-8733569af2a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ba4d6b4-a518-452f-a2b7-155bedab22af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd51c146-9f8d-4ae9-8854-69b4b9bb2f47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--706a805e-0af2-4c76-98a5-4e9f3a4835a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c265f37a-4f38-482d-a8aa-3be9ace6d418", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bfe7e28-b1f9-4e2d-b502-37c03bfb6eed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--016abedc-1ec4-451b-893e-4569651e6a1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd10ad00-6999-4f4d-a97c-6e3c95dd606c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa35d3c5-cd9a-481a-a12a-704b1ddfe691", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2c08017-8cc3-4405-90dc-95839d16136d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71d9624b-2788-4726-8c4e-09ef72cbbd2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--037ad896-5443-4c69-9482-70662b7d86e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f32d2c5b-bf33-43a3-b342-e8c163a48530", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97900389-6bd4-401f-8913-8b7f04ff2a48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a79e04f-5d59-4f85-8ee9-6c84a186b995", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--920b7b99-33c9-4a85-8e57-6da5fa75e64e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f3b4ec8-1130-4a12-9cb6-4baa933f6af3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67d87556-3139-4424-a61c-45c70644758f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6da13d83-a956-4610-8353-29f4bdc0aea6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dba6322-1621-421a-8091-9f0368c0b4c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a1cbf01-859f-48c5-8279-84f29ff05ca2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7072f8e-50d6-4f9e-b6ab-35d6fd1b94ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eabf7a08-65c7-4f44-8d1a-4548e53b477f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a53ee228-9177-4fa4-a64d-9204cbed73b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7885f7b5-56f2-4c0c-8d43-8ad64b1e8080", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5681934b-2d4c-4fba-9bc7-6764f35d0d57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f916cb5-a0ad-490e-b1b0-e422e6f65873", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85a275c9-9e07-464f-898f-d22c3e32aa77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5832505-6711-48e4-88ee-868082293ade", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d276517-d7c5-4903-9289-96caacba298c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f6c574b-8eaa-4e41-9419-4e3659e16233", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b343ac-48bd-46d0-9c09-efa8547544b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7ca64ee-f1a5-49f5-800c-af6c809affc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c72ba6a-0b84-40e9-a4f2-192b62883991", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9a1b392-6256-43dd-8d0d-deafc4ed680f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45cbfab0-4971-4232-8f66-400ad1b314cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad79556-21be-4d62-a5a3-ae4dc9ab7064", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db28fd8a-5b99-4066-8521-73203db25371", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e15960dd-ab4f-4e77-9cf6-165fe5d7aaaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4c4713b-40f1-4263-957c-8a353366b126", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4441797c-8919-4093-aa84-c29f2006eb80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7f8d3c5-a426-4a39-94b0-14edb927eeb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4320dbaf-c1db-4a5f-897a-c069fe995726", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a5415fb-2f73-4ec2-8c2d-f9aeb8149f50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3f7f230-3d35-4191-ad64-ca5b37273180", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.63']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16f71f1f-3f64-4e57-ab52-7b29fe7ef8d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4275f10-7ba7-494d-908f-a1e91d2341fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f7052d9-8cac-4487-bb44-940dac24ff98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bfefe26-d65a-47ab-b173-625d121dd357", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83ce74b5-ef1f-4a27-a27a-7cff91866dc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f85a402d-55cf-404f-a48b-63be848433df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12f6d255-ea44-4166-9e64-ffde47183d37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd7ded15-f914-4d64-b959-c454f81b3593", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a5b91ec-bd73-4129-9630-074ed54fb7e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0465913-73f8-40b7-a763-41778418300f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--974c0b1e-f112-4e87-8c9c-a6eab51b34c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fab2e1f-4907-45ee-bd7a-1a08ced1a986", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e611052-8879-45f5-bf12-c6138242df66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8dbcb6c-b68d-4b0f-a4e4-3a6c43c32ec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96d14f15-9475-4139-82fd-fc221fb6ba23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9762cc3-b9cf-485d-997c-8c43c2f05907", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cf5727d-c929-4c3b-99d8-02117c86a94e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21304874-be8c-4ac6-9831-bb26be7f82aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c5197d1-a5f2-45df-bc50-3055271ea1f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbbeaa9f-ad4c-4d66-8259-c0b1a112362e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d48b1ad2-0356-429b-ab16-8c9e8fb2c520", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebeb349e-4836-4622-9346-5c57c52c2867", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8b60420-a48f-45ec-968f-2a212edfcad4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--462c28a5-43d6-420a-9843-043ed1d85df4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce4612d9-38a5-438a-a1d6-372c67647f78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab0d0571-2aa4-4b16-bdc2-010610bdf11e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97d54ba9-5a25-4982-9aa5-f95b81d419ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73f18328-d004-4b87-b314-179c2febe3c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddd4c9f0-a568-4aaf-b6d8-96ff51ddb621", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4584a97f-ae50-4051-b22e-84e5c4018197", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b16919ab-5d95-4dda-b16f-622cb14bdde5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eecd236-dc19-47f3-a35b-05e47aae029c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7278d477-d8b8-4eda-870f-2bb3fe46b85a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2e0fc1a-9cd7-4c5d-8d3f-d3769e491dae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ad989ed-0f54-45f8-8e16-b3076a4074a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78731bdb-e67a-49ca-b9e5-c0dcff2d5d6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecbab043-6ac5-4734-a1b1-f0682fda9f68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1aa9502-c648-410e-912e-a23159c9bed7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cddf6fd5-a92e-4199-a0a6-53b13b1deb2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca40074a-0086-4c22-861c-b7182ddb4f48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f59f1b51-9011-45a8-b729-3995aadaf45e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcb5f486-9efa-4659-b3f0-3ba129bd8d97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5645e64-ce72-43d4-b9d1-29df76254f97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--562c0b9e-8c27-4bbe-80f1-3f68586ae9ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fae9d82-256b-44bd-9871-f025b5769c13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a74b0919-0fcf-490a-883e-a6cd2519cb6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03f1568d-24fc-40e2-9822-8165031567c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e3e24be-5dc3-4165-a302-48aaf27c97ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--623d680d-7e91-4d7c-a3a6-ec0dc3a00b56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5df38765-71a8-4080-87f4-988aafdfe1cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9d2e924-1f2e-489f-918b-25fe48a8e259", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b20e1d55-c33a-40d7-86fb-a0c384f4de7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7554d083-b048-4d95-8bfc-25c290c2df39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55e3bfc4-fb8d-48a3-b0ef-4187dfd2ee52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46744ca2-180e-452a-9ef3-43fbaf9f10b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a62e6c4-5659-4547-b62a-369fafd0e86d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9e7198e-a20f-45ba-93ab-fbdea0ff0129", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--deda0ae3-06c3-4e09-9836-7c501f8d517e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f40f057d-2f22-4d29-9e63-469eee3b969e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77117eb4-a914-40e0-85fd-3323ef9f1fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98e02910-1bfb-4fe4-853f-f9b6ad996b71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8c181a4-b0e1-4d01-b213-267c92f74ab5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74395fd1-b37f-4a1b-999d-f88429aa89fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09658e91-8794-40df-940d-04c1f2987415", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31843d47-a2ee-4018-b1d9-1607471dbc19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b4b2302-20fe-4c75-b55a-7674fce9de7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af189c33-bce8-4171-80b2-2d455817bb70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95cb8541-9463-43f7-82e0-2e3d1a22244e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72d13350-91f1-4b58-8583-0d782cf5ed1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfded4b9-89c6-421b-a025-7c11be42d158", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b36344b6-155f-4379-9f96-e10d920d434b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7536747-8584-46bb-b9d1-9d04879a9f53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7a1cc37-642f-4d32-819d-f13e0ddd0644", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf8774c1-383b-43bc-a564-8bde60d0d5d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ef0022d-9f90-4b55-9634-40f4fbc1bab2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56da55f5-04bd-473e-92da-cb9160327ce6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--145481e1-951f-4cc9-85de-b34ef100ec09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c74d90bd-52f6-426d-980d-b9b9c8099587", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60e57435-bb4f-476e-8e7a-36514fadcdcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44f3312a-17b8-471a-ae42-101c29b2e851", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e031a0ba-c3b0-49bc-9bac-e09062bd9527", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cda7eae7-2add-433d-aee6-6ff1670312ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e671a4b9-6eb5-468a-884c-f7725ef940fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30316204-a534-48a4-9350-bd8f30900a44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a02285c8-1177-4dcf-a986-76c14c026c70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a137944-f601-4780-9139-914642ddfa61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2852216d-8de1-4f47-b03e-07b35729dc1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fb0e5ae-46c7-448a-9ce1-b557bcd744bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--824a26f6-2d81-4fc6-bbcc-f5c78e010604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--298a3ede-f483-4ae6-8c04-7c372641b927", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73ac64a3-7756-4587-bace-337d0e3958a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f753ee1-0a14-4243-9408-dc875652a672", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a8f44f5-3c97-4827-9c83-848bf4f30924", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4c53910-b8b3-4bb3-a56b-f4e6aaf0ea8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cada7e8-5317-4f61-a1e5-7e53d335505f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ce5a892-64fc-41b1-b732-c9fd09cca942", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7980f069-6b12-4f1c-a48a-ea67b1a7d766", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2ccf340-f75f-4e06-904c-e0a7b5b822a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4910562-85ee-4191-84b3-6f734401455c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b38ad51-6f09-4e8f-a2f9-be537703665d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f6f2730-dd80-42b0-a23b-c4c09ba4ace6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbffcf1b-9181-43df-a2a2-0c221020acde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c312c81-8f0e-4f4a-bc77-df68697ead4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--262ebe9c-09b9-4a70-8707-3f43be218e78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba3f2dad-65c7-4f2b-bf14-4bf6083d003c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff878532-d051-4548-aaf9-e43eb4970c2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--324e5e16-42a6-4de0-b90e-9676d6147341", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23a96b64-c816-461f-be67-8824262dce3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b64d314d-821d-4e80-b7c8-8c8be08f6872", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96910675-e0b9-40af-86c2-8b2ed50c3158", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38632413-fb14-45b5-9f41-6c29dc2e698b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b6cdf5c-5bb8-420b-87a9-6cad2db914d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--171c6c18-7fdc-46b0-98f3-9da30c07aefc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5479cbe3-c1cb-40d1-abef-cebce50770f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38810c97-f4b1-44a9-aac3-c3b794a46d5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70ffbb80-b81e-4ff1-a389-3c229d1f9ad0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.63']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2c5f52e-eef7-4d9a-ba0c-7d79e7fa90a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--375e184c-a95f-4c39-bdc9-84e601cbca47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d317147-bb05-41a8-be1b-b796668df926", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a59bd62b-1e62-45a0-a183-ac66f4c9402a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0f7db13-5605-487c-9e58-9d0661dca551", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71a5cf39-622b-47b1-a7ec-287dea33a98f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f892edc-8fcc-4623-96fc-23d338c9d138", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--337673d9-f64f-4651-9020-928875de7aef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad3464be-6c06-4f5d-b00a-2d18a0695ed4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bcee098-4e07-40d3-8e99-e766bf518294", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b6340b2-aa25-4fe6-ae7f-280f3b2fc25a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f6a7219-af3c-4ea2-8407-b18432ea0313", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b36f693-2a49-494e-9ea3-fecf2b8365b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e604bc2-57d7-439b-8e2f-36847e68a6e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8c783ab-e154-4631-b530-01ac919171ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02c84579-fc71-46d3-b834-cbba2a0d6601", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.18.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f787f4e4-c287-412c-bf3c-8e7731cfe4c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.6.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae3d1bd0-83ab-4990-bbc6-98acd4f7a789", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.248.103.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45eb91a8-caf9-42a7-a30a-620270a286cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.172.63.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd644e0b-c3c0-45b1-a61e-c939d4de4c1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.182.175.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c6192c7-acf8-44c8-94a7-5ad44d1352ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.16.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--393efafa-66b5-4c60-8afa-6af3abbcfb5f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.4.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cc82636-eb0c-452c-9f00-437f44cca8e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.163.24.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb3c51e4-cfe2-4881-9fd3-0a1888029d7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.52.0.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7c302e0-c99e-485f-9d77-a74725f7d6cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.138.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc357728-3c34-442e-beaa-ad7407a9152d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.139.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06542efc-54d7-44bd-a188-863e58d4e694", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.156.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d143d56-e7f5-443d-9b65-b40b5d0e8e67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.157.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f3228d6-d01e-4450-bba8-54fc866213b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.212.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90d05d7e-f230-43f3-8af9-10506fe94c83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.138.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67738b48-5807-4e40-b9e2-cbf949423ffc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.148.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--facc7adf-bc01-4e96-8434-be689411ee00", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.161.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01f34261-9fcf-441b-9ce8-3bc7fbfad335", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.168.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50255ed1-d2cd-4cf4-a06d-c277987d4580", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.78.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b8367b4-2e68-41f9-857b-54535cec24c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.87.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b20590c0-dd87-491e-abc5-81631b20bff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e872fe5-07ad-4913-b519-e945e314f082", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d04e208-314f-41fb-a1bb-15f7be2c6564", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.100.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc7ce702-0fba-49b0-813f-d7dc00910563", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.100.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a7ba87a-7885-4429-b905-b90b3c2f48a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.100.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98cc4179-9c60-4952-adb5-65be9e1db710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98274255-9721-4348-9009-d7377d8ff1c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b143ebc4-7af9-4079-b256-b00c8c48e1d7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11328b8d-7027-48b5-801d-1f9259cba194", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61639a9e-9ad9-4488-bbcb-023065f887c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.119.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3d48d87-27ba-416d-b86c-a2bb30c6e302", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e785684-f53b-4311-a7e9-689d229db836", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c681ce4-21e1-4c91-ac85-6ee342db4a71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a66d2a7b-e120-48b9-8c0e-727c52070d1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3685d5f1-207b-4b9f-90ab-ff5ddf052915", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52e9ed6b-3ae9-4829-808c-5281ac031cc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.128.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47d4511d-4535-4ebc-b11d-c83c5edd0e3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d80c1154-417d-4bc2-8a89-9f8e75c0e0aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6f2045d-1de0-4d4b-8afd-ab81cddd7dcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da341820-d9b9-4398-ab98-afdb1515cb1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbf26440-5458-423c-a6eb-9634c0eaa8d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e89d3ed2-a0da-4861-8ba9-118b297e903c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7747801a-206a-4635-9739-4834ff9f0b1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fa234de-3c3b-4fa2-ace9-a9d7931f2f59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f856be1-5049-4d96-bdd6-c90e14158887", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a3a15f3-5048-49c0-a5a8-a9369c6629f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4fbf309-e9ed-415a-a209-ae9d8c5e6c6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b90b66c-6897-45e5-8f25-0c696fe7ac2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82a244cd-6148-46e4-b054-ecea22136f15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f521d32f-5293-4b59-91e9-1432f83b2998", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a60301f-2c44-44c0-93d4-d9dc4573a0be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a643a8f-a0d9-4e69-ba27-f4a1d063dbbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb2d2160-de10-40e5-8fc8-d6ede2dc6d71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1324ba9-b266-4fff-87cf-50a50eae52f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f5dffcc-5384-48f0-9750-96e21bb71355", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.151.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff8401a6-f17e-422b-9850-774357cbee04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.151.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fda4ae9d-2659-4223-a461-86612d7c5f36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e40f768-f8ca-4d30-aca8-b3df511da315", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee91bf9c-613c-41ad-a7b8-8b4d0d0ba889", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c80dfd0f-e91d-4f35-b313-3d7a7958c57b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d609456-7f53-4944-a98b-5b0ed79254e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fe6ef8d-edf8-4784-bf94-bfc1a90507c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b662c2-417e-46b4-b2b0-1ea86c975b85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--deb053f0-869a-4463-bb0e-51731a533e95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0410b8aa-21b6-41bf-9bd4-8154f5ca0943", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74a8ac15-a697-4f7c-b5a1-cc7890327057", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a673e246-b6a6-4420-a617-ec19fd1ce989", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--851e5548-3d85-4f89-9eb0-1b0df5db4f14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f23e8d6-eba5-4dc1-a19e-f28d6be63db3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f887e91-fd5b-4283-8f2e-3f11b933af89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5eef1ab-d294-44f2-9d30-d801200e01d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c535cfe6-f8c1-4563-b193-d2f7c631e934", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f30c52-5027-4728-9549-1e80452c7851", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77fc24d9-911e-433f-a19b-c7decf68bd30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e660f68b-bdbb-4e2c-b510-a31b0e7aa6cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ca9aff1-b3cf-4e89-a81f-f75e4c0bde71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da1d5cf9-f7a5-4f2d-92d3-ae9358199ff9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb6b4838-2d0f-44b3-8444-fed4d6354f07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c30f4047-0ea2-4d18-8812-9dd234227533", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8116ba9b-5f0c-4ae7-89f7-f54d7dc3d68c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47aae697-7435-4d42-bf50-65c590fb86e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce7e62a2-35b6-4791-b939-6155d24d5fcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad659a32-a6dd-4776-b53c-50a664e61ec7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77188456-7ae2-48d7-b718-0aa6d4684e56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--438900c4-e21f-46bd-9d38-1a2acf41b694", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c240f97-b02c-4c02-85db-99de96a61359", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2fb28db-3a8a-41dd-8462-67e5450b1ae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a1d044c-b0bd-4e9d-a408-12a94b995355", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f37d2e5-3a80-42b7-8a0d-8188c7d9424b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fbb2d66-212b-484e-8407-4a58a56c4314", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--183c736d-21ca-4a46-9342-8d3ddedd4a5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e99736cc-ffd4-41b6-bc0c-f281d776fb0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d893b894-c337-428b-b35e-cb761cde5d55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--074f7b7a-485a-4f82-9886-aac8f8eefbf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7254ae3-84ed-4752-bb02-d4d8638172b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aabe217-c57d-4c7d-a3af-d6857b2ee4e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaa3181a-6ce3-4e25-9786-d280e8f59f81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5341928-11e6-42b9-ae3c-38caedabfe56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--426c7256-eeb2-4ae5-b60d-064e7f53b964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acd42d73-9c8f-4643-a04a-6ca4a679b29a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d47100b-9206-482a-bc36-4da035be175e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78c2f2ce-3e7a-453f-9858-4d7dc323b55c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efbb101b-9c8b-4746-b621-a37c5d912e43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2302074-fa3c-4bb1-bdba-188841f05696", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef36ba7e-9a8c-4b4f-a66a-e4cd3ec1ae97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f1eee08-b3aa-4c7f-9209-be56fe908467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18a2ac52-b10a-470f-8114-a2498371a81c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--144429a4-b9fa-4128-861d-ed1afc35eea7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.176.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8066e2cb-1fb1-4afc-9b22-b15ac06c9db9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--affbec73-8376-40ba-b80b-f0c93affe6cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e12d74f-047d-4239-9fe3-d8558dde0295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9d10760-2fe5-44d5-b5c0-03412ceda53e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24c5725f-1359-41cf-bcae-6d434df0502f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87052395-9087-4e76-a6c6-0e2b2201e81c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4aca49f9-fc28-41d3-81aa-c6847a9ec7da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--461d2bfc-14e9-4d5d-aced-ed49da7d150b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d52949b-1d56-4adb-bb71-7ece4dac402a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfcc4ca4-f352-4402-9248-9914f18a3e47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b926de67-1adb-41de-a481-e0a00925e653", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0b7d801-be2f-4205-aff1-38a0cf5a0b2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54ca9306-7da5-4df0-bb83-75838589039b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6bc8aae-a714-4ba9-9515-470b7f31b27e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--540c102f-bfd0-40a1-8a88-502618f1b99d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ef55cac-12a2-4ca5-af4c-521d2b5c0b8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--547ba0d0-4353-4b8a-8eb7-b261cff8860b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.218.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d145b293-61fb-459e-9b74-60e31b49f241", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.229.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e24ac01-8d68-457a-b6ce-058e47104514", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51de3d98-d55c-4b6f-8fe1-7c9800752967", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8cb2dcb-c6a3-4449-baed-206a6167aba6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.33.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf8ec240-4815-496d-9a3d-37afeb2f1e25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0c6f6a6-054a-4cc5-b370-dc3030bd8fee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b00d305f-9b12-497f-ba3e-50d2ec11f487", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0528f54-a84d-4cb4-b364-6be187b99474", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e7b0496-e382-4ea9-a6d1-7940f7f73559", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e35ef29-738f-4880-9d83-6af2ef79a154", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10ef432e-40c9-43b9-843f-347cdd323176", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--764fb6c5-dcfd-4576-abaa-939188bd4a44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28a1f7b8-a1dd-47e7-87e2-0683dcdd3545", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9bc415b-8798-4634-b3b5-8d19b2f55acd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3377157d-70d2-4a65-9194-74668906cec5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c00881e-f35a-48d7-b07f-2e24256784c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d696cd5-3c03-4103-9620-a702d6bbdec1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a80a0f06-c397-4b70-b683-149d6cda186c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87f35224-83da-4836-a521-f14a9ced1286", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c31aeb32-5c1b-4061-97ce-cf4a72d991c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44a3ff41-475b-43df-bf5b-06af22471151", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed87e82-aa1d-4c7f-bb26-c796a460df41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1403193d-3d64-4fa1-b760-ab24d0a8e7e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.43.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4bd43e7-7785-4370-99d8-f272d25e0cc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.48.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f43a8d91-76bd-4920-b03c-ed179b33d1ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.49.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30011373-8388-4de8-a1dd-6f8248e5aad2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec16e51b-c985-4412-a0d2-f623ddc8d15c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bf86ea8-7aa8-4eef-9d6e-7dd9242d666b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cf85a5f-b45c-4e6a-8c35-7d6491db97d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f819458f-ad2a-4b6a-bd33-bed228a00e41", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7d35862-880a-4749-bdda-fc800180938e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be87bc77-da6c-45ab-93c0-c3e27a32d6bd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88ce8ce2-c545-4a7d-8c86-73d38f2b6c1a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40978a70-d4b4-4ae0-b253-2740c84da8b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.115.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2da7d74-2a4e-4ce0-b949-579c9f6b07d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.225.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8743bf02-d402-417f-be81-902c4914451e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.60.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76b0e95e-42fd-4213-ac73-2673696a0c1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.145.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbc95aef-fda8-4098-88c2-c91fa2776b61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.176.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7be8a1ca-6c5f-432d-b3ed-5dfc46b11d44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.218.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd4029a7-d10f-48b0-843e-f7021ee2826b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.229.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--def4083c-fa04-4551-9a72-8bc136c4955b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.252.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b90a38dc-5752-4c2b-ac68-58df9e65b17d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '166.108.233.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce9964e1-f3ef-43e6-ab0d-821e5138bced", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.148.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2bf1b09-2e1d-4542-84bf-9d32463cb4d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.29.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--414a31c0-5344-4265-ad48-8470a0dd7938", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.47.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32a200ea-76cc-46c4-844d-37f64f03a408", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.76.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cab06552-53d3-4df3-bce4-fe0dfde73821", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.61.80.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a84149b-357d-4706-9dcf-06ff33a7331b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.180.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49370197-c830-4e11-8b92-ee3d3a7ca0b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.239.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5146e0b-853d-48b2-8932-efe5343a42c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.75.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8941eae9-0627-4188-beaf-73e73e7ed138", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7698de8-f603-4c5d-8a26-adaea4ee3ab8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b54bd36c-05fb-4a94-a41e-c34934e51fe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e474a71-fe86-4b62-bd0b-0eed5d26ea1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb0bf104-b400-4bbc-a9b5-3fda375b3421", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2323b50b-52ab-45e3-a9e2-c4ff42dcf656", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77c1bd76-09b9-4ba5-9874-42d5f5414610", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4acfce48-ac38-42be-87ca-479291134483", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17d4fece-9c7e-436c-a9fe-edad48a98593", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9322c474-73d4-4482-bdb9-42944cbe14d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69bc9986-4b23-4558-8c99-3da701e025f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a64cdfe-d244-4048-82c4-b2298ec10567", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5114f358-10ab-4051-a0d9-fdc1c62bb101", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cba62975-5f95-4b68-9b79-7329c6157803", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5810ea8d-5e61-43c9-97cc-b5ad4bf18195", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc12f56b-4ee1-4430-bf83-4ab4b7a877d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--501a62cc-a4a9-44f3-80ec-817d03ab67a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0e08a74-625a-4e8d-9172-52aaaed42c3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d7cff93-d043-4fab-92a0-4fd1707a752e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b6c1564-e115-4f1b-a2f0-0f0513bd8249", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11d6c201-eaa6-42b3-8610-2ed7106df239", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc270dd5-8e81-435a-b0c6-6c7c0467d047", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa15a626-bc5b-4ea2-9054-5166eb630537", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f29f079-2705-4272-8df4-8600cc6871e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61904a73-ffba-4a9a-b353-5825aec3c370", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2590649-e76e-44eb-a323-145bdc8f36fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c933792-9ed5-46fc-a789-16d6b328959e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9746745d-30ac-4895-aac4-dd772ec1f2a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fd71aca-a56a-4d5d-a224-34ce31a210d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.122.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e2f61c2-3462-4da3-a4d7-ee4e212a9a6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.183.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f1a8bea-48d1-4dfe-bc23-0b4f25c78568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.211.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3c404d8-7b45-4650-84e1-4e404b4154f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.222.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f54b05cc-6e76-43ea-8bae-cf3cbca681b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.234.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac53dc44-5f89-4066-bb9c-36d94a5bbc83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.36.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2d822bc-c813-4f95-b913-21a691768955", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.76.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d0d6f34-8564-4a7f-8683-27d8b47b34e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.91.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb8d0218-3f4d-4723-ad53-f10cbc90cf29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.110.195.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--208fdf36-708a-4358-ac54-d31d5c6a2c48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.138.232.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c515d1ff-4e9f-49fd-ba29-f876c573e60e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.113.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c03cbd6a-cc83-4719-9760-eaf20a62360b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.124.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14410431-68db-499a-a021-7c7d7f71b938", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.95.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e9e20dd-3dfb-4e11-a985-8217a588a1bc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.220.237.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c41493-f0bc-4db2-a3ba-9cab7364f450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.227.123.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22243e50-71fa-4c3e-a901-99af4cf23708", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.76.131.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a1b1e27-d60a-4803-9810-8a50b0cd2a59", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '17.241.75.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--299fc746-4158-4fe1-8372-79ddbd1969ad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.65.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bd7cdb7-2608-4549-8bbb-8404e32b64d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.163.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97d63c20-f0c3-41bb-9426-a2d1af321e9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.163.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8acfa72a-7841-4ea8-8e2d-1364204adc6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--464ccdb6-e996-47f9-addd-14515b438ef3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2ae67a1-a5f3-4b95-ae66-9df68c3eca40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d8d0620-6316-49b0-a046-4ed077523a00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7096364-fb85-4488-b2b8-2d9bb1f98140", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60e1c388-efae-4f6e-a43f-f89827dc427d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3389213-2e4a-4b1f-94b8-11fdac444748", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.166.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dce0579a-b07c-477e-a14f-b75e41b9e2f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.167.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbc84eef-8b45-48b7-9f80-702c91daed54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.79.127.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6a42204-ba00-4990-8cdf-933481f2a0cc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.82.129.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cbfd9d0-13bb-4945-ae1b-0eece81555a6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.231.183.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6d8a4c6-c3dd-491f-a491-6cc3517ed128", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.231.192.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30b84b8e-93dc-454c-9877-fc7fdcc7280b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.244.141.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90fce7a7-9e52-4625-a6ad-ca757fd2f24f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.25.158.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a533ab4a-e206-4329-a570-035d526e1d0a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.25.158.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e11fdc7-9d85-44fe-bd1c-df313224d8d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.35.134.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d88d597a-11d6-4cbc-b97a-8b63274f625f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.7.17.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e0f7a57-44e1-4dd5-af77-5f7c77a96b7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.100.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f65a5df3-0a6e-47ea-9b49-24810b123ab5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.19.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f6ce7f9-9971-4270-b535-ca11304df4f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.128.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe3f2fec-9291-4825-a614-5c1cfe14b908", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cd8cd39-e957-43b6-b53f-6cb10d532536", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.234.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c47423be-468a-4157-938a-61f38b292852", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.190.24.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bc3b490-a5ff-43a3-8927-f9ca7145cb3e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.190.89.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f71e351a-b821-47a6-b9ec-0449f3dd34c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.113.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a60eb644-9c21-41ff-a635-25090a727dfb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.113.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--876cdf32-9393-4995-ae0b-f73f6f9c13dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.113.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5be56e54-c6d3-4f4d-a60f-ae52cd84e6aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.114.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88657df2-67fc-4360-a1b4-c67187ffb460", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b41bc9-781a-45b6-ad2f-4fae392cb7a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a773004-93d7-41f4-b6ea-f43f9606a239", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c669be90-4ce3-420a-852b-ca31473633f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7c0d0da-e39a-419e-8fa6-4643a950e543", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--144f284d-2b4e-406b-ab2d-da034f3448ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10d02179-5fba-4710-9334-fdb1cacb93df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.203.216.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5951b56-bfa4-4119-be29-609ae8ee3e13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.206.224.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--589a537d-de09-43a0-8c77-7f3dd8ce0bcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.206.226.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a436d36d-7182-49a8-8715-c6321409d400", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.208.24.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66dba217-f2e4-412a-a892-f79f2eff8030", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.210.81.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ff9637f-c3e7-4ed3-976e-746b03f6df1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.200.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87f9caad-c76a-4e90-8fc5-f10c5f23dbd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.224.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efd2e073-fd04-458d-bb08-ab0e2e4e9a42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.215.144.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--459dbe0d-c7a5-4b23-bdf0-a1dfde34593f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.143.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8ec9e60-75cd-4de2-8adb-0993eb6f475d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.15.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9e41331-3c13-4758-b1d4-847e260f584f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.27.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed9eb410-6db2-444d-bd45-43d867ba99b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.3.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49bff32f-228a-4b04-81af-0319cf6a851e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.8.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e07b908-b5a7-4e7f-8362-3cd4513df034", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.233.219.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41afcbb4-bab5-456d-8ae0-d309b68b6d22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.233.221.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5381349-997e-4473-ac0c-5841821254ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.192.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd4089a6-2d3b-4cab-908d-cb58af714f5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.192.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db6e0620-d49a-4728-90cd-a6e221d19627", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06999265-6714-4f85-b2f4-d09177a2ca02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dd189a2-270b-4e67-b0b5-af958f8891cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fc83ecd-682d-4c58-8ef9-747bdd7b95fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a54fd27a-6c84-4e1d-8da8-1277f835ef7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.21.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f10114b6-920e-471a-8954-d4512878d42d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46237140-9293-4579-881f-476ed54a08ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05920ed6-440a-4348-9d50-06c5e7e479d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a8602c6-c7bc-4c51-9d0c-392f8b6a66c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b28a421-1ae3-44db-b2d6-ed62e6cf5918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18b22110-2056-4ea7-94d2-82e263486b7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.221.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2441f0f-c43f-41a1-8cd9-4b14cd27e43a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6f744b3-c059-4274-8852-ac606482ee5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--857b6eda-e4df-48b6-90bf-910b5f41af37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d71659d-bbca-4cdb-a818-b79847563b6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62e360c6-3414-4d48-b07e-806a7a292a49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.106.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cb38fa1-8737-4183-81f7-62e7764e1e9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8f1a017-ad1d-45f8-8fbb-f8e914cdf3a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be337f6d-fc87-4915-a905-eadf0b9f72ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--709eeaa7-6202-4f45-923a-cc2ddbaf5526", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.117.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a4a594d-3c26-4881-bfe7-ed5074df2fc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.123.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab7d3570-7bfd-400a-8929-f2b383e775a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.126.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b716961b-1fd8-4cf8-a6cb-b658f4f9fa3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.126.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc8c36f3-5a06-47df-8151-682f41c39320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.22.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb19dfd4-8623-42dc-a946-f84f24247b29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.22.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f548ab48-abc9-499c-b88b-c37ea9ac2b4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88b04d1e-7ec2-44eb-a3b4-67cb68cbeec2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dff7831-eb52-4f30-8531-a476a72a8635", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdaa2304-a85a-4f09-8fa4-46bedff367f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7235020-593e-4ceb-aded-608708bbdc97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.96.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cadd235-4457-4101-bca1-627ff6740269", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.96.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e554f393-47d6-4814-b59e-0d91ce9c0ffd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.104.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3680115-04ab-4367-a687-a70429f28a3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.104.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e994cd23-f08f-47e8-8d89-d74db289bfd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.114.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12071aa0-63e0-4ef4-b3db-af0cef00caa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.136.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7026ffbb-06c7-461d-9afd-a0d25297adf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.136.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7be6e8cf-6c34-4541-85be-1f0c71eb2866", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.150.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3128f4f1-6673-40e5-baca-62dbf3cd3a94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.150.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--888fc8a7-4ed7-4bbd-88b1-3f831580d1af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.155.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1f1f630-7e4b-435d-9945-ffd0b8ee7bd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.155.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e154e8a7-6e1a-4c39-981c-7c6f80cc841d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.156.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e5a1be-76d9-4fc1-890f-131eff054bf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.156.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b7610be-0643-43aa-805a-b43a5e920f6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.160.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c768b119-9c41-4bd8-9f38-63c7f25becb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.171.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dc524a7-c878-4f25-a31e-ccdd2955851a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.188.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cb1b1fc-fa12-48ac-963f-019ddbfb2d87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.15.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3ea3003-5d15-4792-9fca-248a739ded5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.51.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d4ce7b3-1c40-4ab6-820a-5ef2b2a0f2a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.51.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf1a6b7f-4ba7-4cf9-ac94-7fdf8f23ba83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.62.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc9f0162-61fe-4c50-9d9d-f35720516425", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.64.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8dba2e3-cd5d-4e70-a386-c8bdecb9758e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.71.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--419bf3d1-b9cb-46e5-9d27-3f265ad3e9b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.71.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f68afbcb-c437-47af-a357-97632584286e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.71.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42b86658-bb61-45e1-ac76-984ad4258404", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.245.225.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc3fc6d7-ea0e-434f-b81c-30e5bc991924", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.93.102.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9396f1c9-0340-48b7-92ec-047313095c76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.199.117.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0ba8293-df66-4e82-bba3-41174c50e436", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.199.92.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b12569a4-4301-4f79-9447-cb4580f55194", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.212.228.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8afba18e-5c8f-4e3a-be27-72bf350b216e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.230.150.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b23eb11d-6301-4b89-b85e-bf6450bbc657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.230.155.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b111553a-411c-4a67-a094-45a363f2f164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.230.155.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d338646b-eb38-4816-be2a-074c0894f43e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.236.16.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--704cff00-7189-41fd-8041-1fb72405282e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.236.82.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92934d23-a663-48a8-9aea-b351da85ff56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.210.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--980e4b7c-57c5-4b91-a04e-5f69f5e739c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.212.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f6fa5af-018c-49d4-b9a1-1b7bd32f4381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.221.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c61bb739-5528-4213-a774-779f1fc5c6da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.221.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58b96498-31ad-4b57-9bb0-24b384438e83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19458349-02cc-40dd-8afc-1df03540bca9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ff68bf2-7ebc-415f-8816-aa943a3dfc08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69f5549c-7423-444c-95f7-bdbf83008a1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--514adbb1-7fd2-4613-99ff-e6aca45639b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e906feef-9f1a-4f1a-8dde-ba1d5543f936", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19be0332-f752-4479-b3cc-f3785f2017dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56c0ca6e-2e59-4a59-82c3-63c9b80922b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--762b24fe-cf08-4bb1-b3d6-f1b289e38805", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab9180e-021e-4fa8-8aff-4e987c50c6bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e750d0fc-46db-46c5-bfa6-e51ac0265918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.226.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d47124c-35a8-45b9-aae0-2ea8cabf0727", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.242.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4426043e-722b-45da-8019-191826023751", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.243.63']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c8bbb81-3b66-447b-bfa9-a7ffcfe90fd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.138.6.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62b72b89-25f1-4e5e-a1ff-9e6ad7add5fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.138.87.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f471234-3caa-4003-b153-ee5702432eae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.107.205.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6333acdc-a856-41a0-9630-3e9acd7dbb7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.107.233.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a02a70ff-c886-48aa-81a2-23015a2800a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.170.144.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53370b60-9653-4d65-85ca-519bbf172d4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.209.246.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9606091e-4069-42f9-9e59-30d20f4427b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.30.48.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eb6dca6-3309-440e-9fd2-7aca21aefd64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.30.48.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74cc2d44-c303-40ee-a43f-9fef3505ecce", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.6.54.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e62364-4110-4cf0-af87-0ea41119142d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.119.25.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56276281-de62-436b-9f46-827c08b527d8", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.120.22.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c86c0c4-7bce-4de2-b085-0f8350b7d996", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.123.2.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51142e0e-0c37-4caa-bdf5-601a8a202081", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.147.144.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf952490-ea83-4656-899a-b493e10eed42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.211.19.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a16052bc-ae85-4e4a-8ace-b996ba4205cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.32.193.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59021fe5-a9eb-4432-a0d5-9f182285b0a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.128.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6672f4d3-2e8c-440e-b816-224171fbd8b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.131.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0eb9648-6e9b-4fc4-b332-c5d08f20fd17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.131.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48d18841-cc23-43c5-a38a-13aadcedd906", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.131.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8331f490-6fdb-4ddf-9ddd-a01a4aff688f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1fee7d2-33db-400a-84cb-58819d99ecb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a45391d9-5315-450d-a714-229dd1065105", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10685382-19bd-47b4-add2-fcc9fce2b290", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec407664-6615-4ba0-ae03-dc7df7202caf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a9b8259-262f-46ca-90ae-1d338ce9db53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fe3b3a0-e2b4-4023-8e7e-a79e31b1dbae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08fd8836-f5e6-4723-b47a-de423a2aace4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a78d8eed-67c2-4b2b-842f-0159887ef869", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb479e08-3c04-4408-90ed-e8ca47887691", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9745f754-7159-4d44-8a5f-dfe67b1bdb43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0456e32-86b0-44f5-a331-6dbe21b45f70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a208b45-6d58-4534-b139-94fa85bcfedd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2bf4b33-f096-46b7-aba2-91a420c79a61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68a404bf-671e-4aff-86bf-0f34d39f6280", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0aac203-65f3-48ff-b06e-db0d5fbb8aa6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--875ecd19-d178-4149-9ecc-4105b2070132", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dde235d2-a078-445d-8f07-7b1b59a3ef0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--701b7932-e835-4177-b32f-d17425bc8727", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--442ea33b-bd99-4850-a028-42713dcf706a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b212894d-46aa-45f3-99bb-4962aaa6ac3d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6935a007-651b-4230-aee7-8dc5a2ae6b13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49ea6d0c-a491-4faf-ba2c-683b855c4a46", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b60d28d-60a6-4a12-ba08-f3c52935a181", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1044b18-7fbc-484d-823d-1e12b9f67057", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a359cf8-cd75-4016-8326-78d0cd6d201c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b851bcee-5e28-4b39-a5b3-fa454fdeb803", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68d40d08-30f7-4808-a3a6-ac9efefed51e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b468d775-a144-4546-9902-bfc86102995a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c5d6e5d-459f-4463-a4a8-34ea27825433", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b44b8af-6d0d-434d-8b7d-dd5b764033ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51856c7c-a139-408b-a710-051326e0139b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f1ccd7f-63c7-4b55-80ff-693ee55c8a31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f997a718-5dd0-4459-8c7d-64f4863ca7f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--720a0deb-a7bd-421c-87e3-a6a591d6241c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccbd57a6-74cb-43d5-962f-be1430afda08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af961e50-ed7e-4c90-89c9-ddd2927adb79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--631008cb-c72f-478b-9b09-e220a77b41b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83ead3b4-5f6f-439e-9703-99cc276ade4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8bff395-d474-4cab-ba0a-4d069e181492", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d92ea274-f142-4be1-af33-7c0d6b9253c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c61ea404-00ff-4a53-a8e5-f9a03afac0c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5532f79-8099-437f-88f2-afe087ed6117", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9ea070b-41e7-410b-b1b4-55330b715693", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98d77527-f9a8-4193-8bca-60144e121ec3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43cf8c9c-22d5-4d0a-ba20-2bbff3992f15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b642dde-5d05-4ca0-9a84-4ed6f3d04b81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd515632-4589-4bd5-83a0-131f0c336691", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--502735c5-4b96-413c-993c-416faa4536d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56e46796-d32a-4c90-8ce9-e57fbccda8d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33850fe4-a352-45d8-89c0-b7dae8098fe7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd16f6af-cc4f-4c35-8ef6-9abe63e8e8bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e7fbfe0-4ef2-4aae-a15f-9ab32905edcc", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.212.76.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7821608c-9e63-49dd-9bb1-1a39f05ec4e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.22.38.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b9fb8ed-a0cd-491e-9315-86f7016ccf6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.26.126.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba73a4f5-fb11-4cee-a034-d5d901e9b0dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.36.214.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45703930-d38c-46d0-a8f4-c326a82bbe78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.75.105.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7579e941-a500-4ccd-894f-9407321dd53d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.85.11.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b211fd30-8607-4e3a-945d-8446c3717eca", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.105.107.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8768b408-11a5-4f23-93f3-cc7f3a335def", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.105.199.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f83edf44-af48-4dc5-b45a-13a2dadc70c7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.1.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57c06bf0-379c-4e59-b8c1-b74f06914f4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.168.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09b60460-7977-4a2a-a177-a92bd1706a4a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.18.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45ecdf37-bed9-434f-a6f4-2642585d8ae3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.242.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22d9fb7b-5e1b-4a14-b374-dfceaf58980a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.252.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b36cbee3-7b79-4ed8-aa44-e709537b1e7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.46.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83bb2c1c-472e-4d29-b977-90a71c8e9f71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.84.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73ba3820-ae2e-44a8-a08c-1a2f5aebd500", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.53.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8ea21f4-2ffb-4cb8-b201-aa558b53a60c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.55.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01d5cac3-3eb7-411a-9030-f5bc55579521", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8265c2b1-38cc-42f8-9b06-3dddc6c26d91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14a9751d-6a11-4a64-b19b-858757617983", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.238.235.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a6841bd-f682-4426-a653-d11592f365dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.239.180.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5108bfb-3a76-4975-a528-06ddcd35222e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.1.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8b1a296-4cd6-4b10-b4d3-4beef6144efb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.17.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--769696f8-4078-4d00-9479-502eab6d7ef2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.216.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6df51788-ca82-44f9-b618-1d0b6318a7df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.31.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10245210-028d-46d4-9cbc-afadbca46d4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.55.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78b4b823-9212-4e75-a6f0-6134bbd04b08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.83.206.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18717c5d-b3de-46fa-a5db-c5a0af3758ad", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.0.124.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48f91375-6962-4e50-ad8b-4dc6e2a6ce26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.25.34.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45dbc58c-7da7-40aa-b90b-6d15fd1ae539", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.32.33.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56f666d0-8223-43ff-8cdf-aa6175b7ecd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.146.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2fad3a4-a6d8-4ab5-ae8c-e78ac716c285", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.61.232.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d71d71af-ec52-4112-aa4b-53ba9acfba1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.99.197.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6514b9a5-39d1-422e-aef0-735946b1f5af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.118.145.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2372def3-c1b5-45bc-80e0-845ea9135fd6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.118.2.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6960cade-ac55-485d-b799-0363fac1b7aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.119.209.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b71e286a-8e3e-4c07-8b43-883f90411f89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.133.212.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a11d2ca-dc72-4bb3-b697-0a9348962292", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.143.235.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--577e43f9-bc87-45de-b043-2bd3353fc2a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.189.74.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66d7f60b-ea37-4e6a-adf5-fd3382ea1f17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.190.15.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15444d7f-f230-4ea3-bbcc-85ace51da75e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.217.208.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d99fc67e-51fb-461d-8566-aeff3392c279", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.221.179.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a35ddfca-acac-499d-8142-c5e6e4f4ed63", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.221.195.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e81178d-bcaf-455c-b6b4-406b19bd6bd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.222.219.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1588203-1772-4eb1-af80-8d3ef5b93d11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.224.182.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--021cf274-af49-422a-a11b-cc66bb499c50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.97.5.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb6ee688-2407-4d08-b6e6-04f3f8605f7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.128.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b0a81ec-a27c-405f-a7c8-42238eee2a5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.128.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57264d70-aa5d-4b96-9c99-d7e1760aa728", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.155.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67c8360a-fb27-49c2-b69b-95a49c858874", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2010-0738. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.172.114.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0738", "external_id": "CVE-2010-0738"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1ccd461a-06ad-472f-bc15-bac9e7cf2d4b", "relationship_type": "indicates", "source_ref": "indicator--67c8360a-fb27-49c2-b69b-95a49c858874", "target_ref": "vulnerability--bdbb0df2-8c45-4204-998c-24a9eb4e5757", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bd380e3-115b-4ee8-b158-24aa7e606ab2", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.179.236.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d53b4a7-31de-46a7-8590-7e5b544a061c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.182.228.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2be4a21-2da8-4f1c-97a1-9958c15cd3ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.188.45.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--692b3f45-0b37-44bd-98e9-52ffa34e9366", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.244.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--796962c8-3a3c-4021-9633-4419f337bf00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.93.3.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1859dcdf-53a3-40c9-ac07-1ad17291fdb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.95.231.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81258167-6099-43a8-b6e1-29193ca8fcfa", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.114.119.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddbee690-6d4a-4547-9f7a-f15e63758f72", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.116.220.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--951de6ca-da7c-421d-a8f0-c6d7199881a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.119.209.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e837268-ddef-44de-ab2c-68930e622a09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.198.192.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95495307-d408-4fd3-9d4e-da4081eb852b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.234.16.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db6bdadd-bfe7-4927-8ca2-8dcc76cf10f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.78.65.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b256f1b8-b461-4a4c-8e83-98bcc3af044e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.16.3.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8d2ec22-7c6b-4527-a196-a1b8b8439a85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.187.140.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--839d37ad-325f-4ecb-98ee-68ab143d1b4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.44.73.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b36e8fb7-e87c-416c-983a-b5d320abc165", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.9.3.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c74574d8-fe7f-4838-9c1f-297b48e6151b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.96.95.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88bfaf8d-6a71-4c3f-8919-d73a7ba72448", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.128.178.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46cd4e3c-3247-4a51-acde-3a45178f107d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.129.249.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8dfd81f-0408-43aa-869d-9e488dd8d579", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.14.29.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3068c45-1db8-4c4d-a17b-e95f20e9a062", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.207.186.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e639dd8-1a03-4e46-af1b-ed98c4b6fafa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.232.212.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--227accd4-6c4c-4c24-9830-6740b48fb1be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.239.58.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea31ac6e-20d3-416f-9025-f83e412d3ea8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.240.23.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0124d42f-f5ea-4dbf-a9c2-4cb0af0062b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.36.35.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96e356cc-1af0-40d6-ba93-62007dfb0e25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.56.196.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dda1d3e-461d-48ba-843a-abec1afe80c0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.91.11.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc4eb2cc-89a4-4876-8740-10251017445e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e514056d-230f-426d-819b-9b694a782d26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3597f003-a7ca-4239-8f2b-adb4fb29c2a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--047b6989-c566-4028-a0bd-4eaff85d93f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6af59633-1c04-4597-84f0-eca260bf07f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d93cc801-f058-4f8a-b581-3394638956cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56cf9736-5066-4eab-9468-4a7ce349c24a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85baffcb-c79e-44c6-b4d1-0d8c4b8ead2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--549b27dc-fbed-473c-9036-5abbc05781d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34bf9d82-911b-4a37-9d65-d0a6f6963499", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a33dd4d-179d-4102-b996-79ce82b45659", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b91665b-527f-4242-9001-22d4c06dccca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27700906-149c-4a9a-b96d-422306bceb1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0d8d382-6b1a-474e-b89c-4c79fd95f298", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b95fde70-39df-4be5-bb2a-a784b7ae4aea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94c9117a-154d-4d16-9268-fceced438ec0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed5c9f2c-1440-4d28-931c-aa1d1bf262b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aa1da02-a6f2-41ca-819c-e25801b56ad4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2da527d7-7ce3-4a19-b56e-836fb49d6794", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12aadbae-5ee4-49c1-b986-c505c2f3a11d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04478b2c-e5d9-4960-b7d8-9bf0cdf85693", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9586ece-4dec-46a6-a339-a923caab2f36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8d04357-aa2b-49f8-93fb-206bc6f393f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5b54eda-939d-472e-a1d8-2093ca7e58a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b0dfb98-7f97-4433-bd80-56394d082ffb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c46ae94-c95a-4521-9834-abf9884f61f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffd20aa3-d9ba-476b-aacd-4f91f305cbe7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c585d973-c03d-4345-b468-b942248d2279", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3e9506c-7e85-4fa3-a12a-37e0b325b7bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b32559df-d7c5-43a1-beff-b99d5fb03a30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4f8aa9d-8eb2-4146-bf45-34c1e669c8c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19430d68-8069-4852-8d78-7a32a8926d22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f55bbcc4-6096-4a57-8711-80269e43c012", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--957532c5-f91f-46d0-81e9-d662a1e0b24c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21a48221-ffee-47b0-a67a-9cb2806e996e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.157.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d74ea871-fc49-4677-b9b4-7cceee259cf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.32.16.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a813fb2-7699-43c5-9d04-bd1c1a6a72cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.100.87.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a70f204-a7ca-46c3-85f6-1b2063432f43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.107.80.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83f22f88-0967-43bc-9ad5-5f1eb1323e9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.117.118.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b3c3f6e-c652-4c7a-a5e2-d8eb88ccc611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.12.59.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a8d304-0968-49bb-ae72-11d811f0d924", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.128.227.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c6015a-0b5f-4255-b45d-c4c88d45f23b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.132.187.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78baf8f0-8582-458c-896a-62380589eac0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.132.187.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab436fed-13ea-4f36-b33b-9d51aa3a116d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.132.187.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--045971cb-41e2-4677-a343-0c7e27c05e49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.136.15.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--594b3dcb-3f58-4906-be9c-777f7d4cf70b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.14.58.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--856d30ae-8994-40bc-bc77-4c6c659be563", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.142.99.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--384a87f6-7a71-498b-9bc8-e8ed7c1e10c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.150.191.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60e52195-29aa-41ae-b053-9a0cd4ebdf1c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.158.22.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cd5b21f-5855-4def-9369-05318b0e54af", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.158.23.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d544a34d-92dd-42fc-8db1-7f5c783e88df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.169.4.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33162aa0-9a58-4e5e-84f3-6ed4eb7d753b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.169.4.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e7fa52a-7c14-470e-b07e-3ace6aaa18c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd0327fa-9504-4f67-ab04-1f4c2970822b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d85ffeb6-3861-491d-9f62-a32600a48933", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f2efc0c-0d3d-4ca5-89c6-0cbba7a06711", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--533908b1-0668-4ae4-b90c-1b880fa8e781", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fbfa2ec-72be-4793-90d6-7442e7b2cc67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f796bc1f-8591-434a-8887-f93a1f268cf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--467932ff-6060-4884-9f0e-48b43423f2d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.189.182.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0fcab46-040b-41c9-b806-fc5430e2d248", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.165.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71c98bf7-58a7-448f-ace2-f1db9806e314", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87da602c-a54a-4d33-94ba-5d95b770ee64", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e17bf6d-7d90-46a3-9875-b60150888df1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc725a04-288c-4a56-8988-aff92610fc19", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad5f0f42-6d06-406f-989d-9c24eac4975b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--760c7213-e239-4b0d-af98-4a889cd6a22e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50990dfd-dabe-4166-8e91-3c71fcf84629", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a56825e-7b44-4556-8bec-57c99b3e264a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0067466c-f176-4854-93a3-4708f16a0d34", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbe2d677-8906-4d49-95a5-4cb622e91e8b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee9376e0-2b67-461c-884d-5c7ad97c0eb3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba7a843f-e78f-45ef-9536-f16ad41f91cd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34731e2d-f52a-4fbe-8d5e-7c8a63da4b41", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8bbca43-2851-4ab3-aa7f-98eba4f263e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b599eca-b5c9-491e-ba07-0c7f81b9b9ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab746561-2030-4dc6-912d-f34fafdf0781", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd499f26-6b39-4094-be5a-21d00e47bd3e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef9d366c-2921-44bc-82e3-1930eb6059db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6231ce04-a623-4039-b7a1-9a458f757d40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc2dd476-a160-4fab-a6aa-c194327178d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54120181-527f-4520-a21f-7dc6c06d9f8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4fa623e-6497-45ff-a99a-bf5d0913f142", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff38693d-8dd6-44a8-b6fa-6dabfdbe9d98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f08b6956-d0f8-4bec-8523-2983a06ba75a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20dcb6d7-67f6-477a-bbc0-78da7726a2c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71a24cc5-b20b-417e-9ea3-4ee5cf75c08b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efb6e659-f926-4a0c-ac8a-abf4e5599fa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.202.58.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15395691-558d-4273-9783-ae170fd988d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.204.1.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbf2899f-5b8b-4db8-a409-e5a97c233b9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72a74830-35b0-4d5a-8933-87d086cc176d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.218.138.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1ac61d-f779-41b8-8b96-c568c3756aa9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.224.128.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0de81710-b84a-4299-956b-6699a5eac790", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.196.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb57cff4-8d49-4c3c-b5a9-0be1a73a0b1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b9f0e7f-b4a7-45e3-8e18-5234ca78ebe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--674a67f1-7706-4531-b695-7a07efabe96b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--700478ed-0904-4ca3-9ee0-55eb4f7e234a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0ef880b-714b-4ea3-bd1f-18583e17cb00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9b7bb78-0403-488c-8bde-13d11f066a4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e58c392-6c1b-4e81-980a-098b3219958a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.228.72.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bfcf9d3-e469-413c-a91c-ad51755834e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.238.231.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d63107c-b79d-4bdd-9b34-590f47cbd41d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.239.84.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd482b0e-b574-443d-a21a-4b69be3bdfc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.241.208.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b250715-0886-4915-9ccf-e310dbdd98f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3248617a-948c-42aa-8e4f-0c567c94dfec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--884ec1de-8dd9-4d06-a8e2-26dbfcbeac4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39bb679d-2126-40cc-b75c-384d8fb8b2ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03a5bcb0-a123-4f41-a0c8-84337f9c8124", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85cab796-3edb-4176-9ad6-255cdf86d258", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--214a8f79-c8a6-4127-933f-7f7be24d4ed0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--393c21e6-fb87-4990-9460-b3d549fd6c59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f208f71-1c9e-4641-8081-6e77612eb211", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ba3822c-993a-4ffa-8048-b94dd04481bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4723e1ac-1162-406f-a399-f4137d1eeb51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52bf148c-0e77-48fa-9186-0eb96e468582", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b4bb747-bbdb-4ead-a287-b4c56ac003cc", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4137afae-73d5-4f79-a543-5c2987d2883d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fd8cf70-07c2-4d7a-b69f-1082f09a6327", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91aba508-b511-4526-b91f-3b80e0ce7da4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb7b2ab4-34f3-47f4-955f-0b0ca2ffd3c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5845897-60b3-4b9d-b8c3-ee1311edbd9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca52b564-b361-4c17-8ad0-d6e1a56eb18b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d87a367-1970-47b1-9741-67ac31d7e829", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3a1964a-1824-4140-9e33-c9877c1eaa71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e009b558-bac9-42bd-b831-5df91e2c0d68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ebfa2bc-3b53-46f4-997c-f4837e978c94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--917f7d8f-12bb-4264-af6a-3304b7c5c165", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a78f7e9-de21-41fa-a0f3-511fd96b7398", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc7e3411-abc8-43b5-b395-7d5bb3d3925e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.253.160.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b03018f3-ee7d-40c0-8fb7-7b47c9451638", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.255.100.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f751ae04-f32e-4477-ae65-0c5e567d4625", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.36.81.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a4f6fe8-dd0f-47a8-bf74-afc32a45584b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.39.204.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39830746-23a1-47cf-b799-166e88fa3dac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.51.206.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6cd52e4-9faa-425c-8bbc-6bf7a9863950", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.65.107.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca0e572e-d238-4b60-8f1e-e4ef24f7a0ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.88.103.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93a83832-7378-453a-a2b5-6cad80f8903d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f144b39d-fe43-405e-a970-38cf8caa95fa", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd0abc86-9d16-4b99-8626-4c898ecaca6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99972e50-1b7a-49ec-8f3e-1ddddab8cb89", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.121.244.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c90d637-7586-4bf9-8b1a-7cfab054238e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.149.199.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f266694-b8f7-4835-b33a-9ea0c0745698", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.167.225.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4393f5f4-caa8-42f3-bb3d-a595a39ecc9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.192.36.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2291187f-4ef6-4950-a0a5-b9b3122cc1d8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.208.148.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--475f3b6d-d497-4a86-b77d-9a40f1445aa4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.233.118.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49078667-fc6b-4c4a-887d-7d90752ef7e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.233.184.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd3e2970-e076-4eed-a2e4-94ff497ba704", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.53.46.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05c36580-94a3-41b0-81f4-c08817a8da8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.53.65.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1152bc88-a3e1-48b1-ad5c-65d57824b8d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.67.30.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d12ff72-0506-47fb-b402-2f8438076d2f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.68.83.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--991d450d-b9d7-46d2-aa67-d793c8e8274f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.120.189.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74b5c59e-e229-49b1-90a5-a7ced3f4521a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.146.102.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14580c1e-f65b-45ad-bd9b-b15a837a6f97", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.154.100.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08713232-d90f-48b1-832f-bd6e6272c007", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.189.164.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1310ac7d-f0e0-4f3a-991c-9c6af83b3bd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.194.42.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--252c55a7-3ee0-49d8-8a71-435ee448dd3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.209.185.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfb844b0-b04f-4681-9016-91d6540c78af", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.210.77.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9de0e4a4-b248-47dc-bfd1-12e26332f581", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.45.95.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43cf773c-ae0b-4123-b257-6f6042ec57be", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.165.26.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec26d7e4-a236-492f-9fb3-c8408819e3d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.39.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86085d22-c2de-4456-9fde-38519445afab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d532e4bc-82d0-44d7-a783-9e3695b61498", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cb55bf0-7939-4dd0-ac5c-8974465f2e4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58639c52-cde5-40b0-b1e0-1875bc6028eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0e456e7-0950-4f5b-bffb-c9033bfba4ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d854bc78-5727-4a39-9826-48fdeee4f20d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.40.21.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a61e0c3-8dc0-42ae-929f-fa59ee50905c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.44.20.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--188a8333-2a8b-41ac-a150-8909f20460c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.56.195.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ef52edc-cdbc-4f16-8b14-d787066c0a4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.201.207.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17db7ccc-d087-406a-8221-3e51c1123e53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.45.238.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8bafd12-ffb1-436e-8a04-b05d4587f30f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.50.142.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3778afe9-5dd1-4c31-8ca8-654fc3efa2e3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.113.188.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a437939d-04e5-4022-a16b-fcdde2b7b73e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.119.187.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a08b0444-f5d4-4df5-8268-38be2cf77ea3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.129.122.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32261d18-43d7-403e-a098-c1e20c091f26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.134.195.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc63c26a-7f83-46c9-bcb4-ce292cba9c14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.153.21.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e93fa1c8-9291-4ec4-91fd-e8e2dcdc40fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.16.194.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4ff0921-ced0-40f8-aeca-c446f6fd3686", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.165.144.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2ee8795-7989-4802-8e28-26568b05cf05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.202.149.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e96ed704-5ae7-4f76-952e-9f812759d916", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.202.51.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e3f16ca-dab3-415f-94fb-bafcb861e135", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.202.91.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--501f43fa-f3af-46d7-8fb2-960a5de4b406", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.221.167.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15bf7ff8-4a92-49c9-8920-6594d1b79f45", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.32.246.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e91ecc89-3937-48eb-b3d0-34e64baf34f6", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.73.249.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--797c17e6-972f-41d0-ade7-bb257f54d4a7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.85.41.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--495c5ab2-67b6-44da-890f-2e95308f563f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.97.254.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfebb20d-0871-4aa3-99b3-76d1fc39c2df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.109.187.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5adbca6c-5b1a-4388-9898-95b4dc2cdf94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.241.76.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eda7ccc-88c7-486e-8102-004e6e9c68a4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.96.221.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59781518-dabc-4982-b39e-aedad27590cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.109.200.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a64b6da-84b1-4c61-b218-56ca029eb595", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.81.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4772b219-005d-4ce3-9b46-7e92fa751aaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.84.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--287b4429-79dc-4b76-83ec-28ad8491535c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.88.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--099bdd36-cc57-4d90-ac9b-de2b108ab996", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.169.179.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--516ff83b-179b-4397-af34-54beda3d5d77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.195.68.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9610b3cf-64cf-4f11-b42c-3b3f7a7ea638", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.210.198.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46cb7839-9a61-48a9-80c1-a88596f5fc3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.227.134.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf5f9331-0df7-48b7-88ac-947fa1fb810c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.236.240.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2880da3e-1c7e-4f6c-ab52-1e4109c53d08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.250.227.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f53c0792-561a-4124-93dc-ca9aac7f9003", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.250.235.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61d40d7f-216a-40b7-92a9-f75702d58fe8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.253.248.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c33f48a-30aa-4b35-a532-1672e60c7d19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.253.248.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ff46b1c-c07e-4146-9457-7bbd23ee50c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.3.145.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7235ec2f-f22b-4843-aa8a-2b31ee5499e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.3.206.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--481dcd8a-d909-49f2-aa90-ea5ea9c791ad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.36.52.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--926241f2-25f1-4a65-af20-08168e52984a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.71.10.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af0b2f8a-fc25-4ff3-9e3c-2e25591e20ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.81.131.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60bbdfcb-0a45-4908-ad94-253163f7cba0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9881c25-ef89-431a-b2f7-cf9c4402a4cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee72775-9960-4471-8b7d-f214e353eefb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae8f4d0a-672e-438c-8ddd-faa6bf5df143", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d4bc947-488a-46b4-ab27-dd60fa16b26f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5e3aa3d-5c96-457e-8bf1-3146c0df1315", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf6554b5-ec07-4ac8-88dc-a8335bd8d0a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29e90b2a-05ff-4aeb-8adb-a762b9560f36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04b97c59-f709-4854-82eb-4fcb4e48243e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0b1293e-1e48-44ba-ba93-ab9bfd472a33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77fd03d2-b5ee-4be7-b4ba-a0ecf45b5f15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08798de4-274b-4065-b25c-9ae662bbc2ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb6aa1d6-2672-4c2a-b32b-4a68185fe0c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--332ea12e-4480-4582-9cb2-150e5b36471f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94f215c1-ac46-48f0-a2c8-a3ee4461342e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6b6ac16-df84-4835-9dbf-4767c460c825", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec5f2037-d807-4e06-a493-b4ba25323f8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f48f473-5d65-4280-94db-8d2003323abe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--997ca7a2-8667-4659-a7b5-d1d9dc3b37ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fabd90e-28e2-42df-b093-4067c96c8ea7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4270b522-43b5-4af9-b539-4a7ed57c0418", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ed59df9-19b8-47c3-979e-a5600928a495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--773225b1-04aa-49cc-91b5-4441f93e4a03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e86d7c04-5847-403a-9b68-e75e7dbc85ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.142.43.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2904c27e-ab2c-4e8c-9fcc-892304548d66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49322054-2b65-4195-a246-7e36d445ed08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--487ebe6d-558f-4013-86cd-6a9a4f849c42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb5a1c4-df82-483a-8151-54bd9d79c295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c9d35c-143d-4f78-8f2c-6bf2b2f2631f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85439bce-f496-4a33-b915-797612135252", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--630b59f2-6f58-438b-b15b-ad991fa3f350", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdc07dfa-9aca-4ede-a17c-cbc96823937b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b98d5db5-c111-4ca6-ab28-a16c8b4262d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0225c311-517d-4485-9277-2b04f1ea2b86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f17a0548-4e68-4f8d-aa7e-e84969da260f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f4f8aee-77b6-4567-87c3-dc031a1c8fa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbaea669-1c4d-46e0-929a-58cbf5c0d3dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca2f4c09-a5ec-4359-bfe8-646fb00070b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eacbb54-ea46-4744-b657-87a8c64f8e79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c83b48c1-da12-42dc-a1d3-33fd6269f42f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f5fd468-285d-4f12-8d6a-6c9e208aaf04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c32e1a45-1ef9-4d1b-b92a-7d6600a80821", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--192fe54a-5d25-42c6-b719-b2fac9ba743d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cae5097-4746-4346-80df-9b7bc35d58a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f55520-9489-4512-bcaa-8af471d28e8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d17b470-ef80-4167-be61-f9a3cd2645d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f696805-1b73-4fa2-a165-0fac91d04d64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d77ea09a-3407-4730-9381-c356151cbc19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f1d6421-d07f-4397-bb28-9cf378707e4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ffcaf17-462c-45f3-b324-bfb7181353b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86887400-f2f9-4635-b31f-fbe41893c791", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3478ee4-566c-4dde-a10c-881130c90fc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1681c46-e098-4924-a04e-1bd561c1ef34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc65e58-22a5-42c3-9340-f84addfd79b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d7bd613-edc8-4dfe-ae2f-0820f9836e3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8e8d034-78bb-4838-8201-bf999e459094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4c1f99f-871a-42e8-901d-668976ff7920", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1778f7fa-72b7-464d-90da-64c2f626c377", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00e2802b-f371-4359-89e3-c370afade937", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0871e25-fd77-4f5b-bc25-aa0c858ded05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e812ad39-623f-434e-82e8-e257a2b871f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d039d04-454f-43f1-b571-f7cd70ff2a15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.169.194.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94ad3607-399d-4590-aaa6-ceb59ff3e5c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f9acbf6-b168-425f-8422-bc74ec45375d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8afa4e86-3ffb-4c91-81aa-e2b4242e8656", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--048926a9-dc57-4be8-8e71-f08a06d327b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6af677b9-e912-455a-a355-feffc423e096", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.203.10.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69810b6a-1fe0-43f7-82e8-3980b5ee25c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.22.147.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24e87406-ddcb-40f7-945d-45b1cb3f9f8c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.233.48.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5375661-5544-433b-8c9f-20e6b1de63fc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--998e56db-9fb7-417a-9074-9025835b8d02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--651986c8-1c34-4611-bf67-db5eac9abdf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b39070b0-2b14-4d25-b87e-c2cd0de05f79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5488ecd8-29d2-4cef-8abe-ca962e9558a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f4b1d19-e682-4e31-9c7f-7e2694b6aadc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95b01cfb-d366-474b-8413-6e8b1b6a2e1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60797665-79b3-42e4-bc0c-5b486e1a9c19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6119a3fe-f1b8-4d04-898c-6fa5a8cfaf85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a772364-0ba1-4388-b149-924d81a6e0cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f8658e6-3cc1-49b1-aa1f-8fd7b44f6ffe", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8080669-915d-416a-a2e4-df6c3956c30b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.70.122.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc92b175-23b0-438c-92cf-d2a279180da7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.107.115.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d7d5fcb-a9ee-464c-9634-9c155a5b264a", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5207d12-a28f-4313-86ed-272ffbca2207", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27e9bf2e-fd1a-4671-8df9-2b4f66257441", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78bd5768-3c6d-43fe-93b6-155e3d7766c4", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61febadb-0a64-46a5-b1bd-c8077eeeff3b", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b41a12b-1937-41c4-a052-53d663636a59", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--153a2d9f-5e89-43ef-ba6a-02555e8b82d6", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce41a5ce-6e83-40fe-aca5-31e3ba7a2ddc", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42f4398a-7735-4898-9825-30a0f3ff1ee4", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a05caec-8e21-400f-a05b-372bdc2566a2", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ef33f84-f950-4359-8104-61268394228f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.120.230.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6cbf10a-5b05-4a51-bb70-ab8d85c2f93b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.15.52.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b3e84dc-8c48-4763-bf99-e305e61d7eef", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.163.190.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6fee3f4-31b4-42c6-807a-343d93288172", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.107.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac64817c-7c3d-47cf-8096-da5f6f4bb5ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.107.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94cf3b1a-7312-480b-8419-a83b28ec3040", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.180.48.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd2d8497-136f-4342-88a7-e0d968a06f1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.180.49.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f8f0c8a-aee9-4d2f-91ff-9960f297df2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8df8932-7a71-4735-823b-d7368a67dcf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--192ae0f5-87da-4443-9da8-203e5a977a96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b85a48b9-276e-4d12-ba91-27756b33de68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8457a39a-d59c-41bf-8f97-b4490d2091cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f38462c-6316-4022-ae25-45c53d774dcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.195.210.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfe61eba-8e97-44fd-a78d-f22c23274ee5", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.213.3.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54fcb37a-1b74-487e-ae3a-51df86406ed1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.233.64.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab7ff8b0-bb1d-4612-aa2d-107994056614", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.5.53.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e83a88df-d3ca-49f3-a4a0-8fc4bdbdf682", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba0570a8-220c-4245-98e8-ab54e3cf020c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.59.206.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8acb0daf-1e40-466c-87c7-3521284a53e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.68.225.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3e1505f-3a9c-4dbc-8e72-ee95834210a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.79.103.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce042a64-1732-410c-9f52-fe1afc785327", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb3f5161-48ce-4f43-8632-5c6c603a9b25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ea5794f-d88a-42fb-82d5-8a05e6093061", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c90ecf3b-77ab-4695-91d0-58be2eb5f2dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29508f0f-c100-40de-a172-6e6576041c8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f460163-de10-43fe-927a-70e45238aa5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a703300-483e-488f-a718-be2166ddef4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef6e4e85-1dee-42fa-9ed5-2798d607ce7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c1fcd5-f687-498a-aa0d-ac1f1d26e31b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1c2fdec-5bda-41f1-a321-5155ce8148b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89bed5f9-4192-4004-981c-0f5e87076bf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ee424b0-88be-4f8e-8705-bfc32453e7a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f1f64c3-93f2-4d7d-bbc3-8968b08dc8c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca8a8cf9-04c5-4d1e-b2bb-71d35b796266", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2b5cda7-3a37-43eb-b2c9-c30c026371e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cbef57e-702b-4ee2-bc26-4733dab74353", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8645ca66-9ea9-448c-8031-5f1f74407486", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b68674b-61fb-46e4-b18f-965a26deb3c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62bcb09b-6bea-4c66-92d3-0276df8e60a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f4e6b5a-19f5-4de5-aef0-7789c1ebf41d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a95113-5da5-467b-ad8c-8aa8baf66333", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab790848-65ed-45b5-8578-11847d1d35b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6388d07c-9a39-4e2b-836d-24d543da38d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3bbc9ca-a7ec-46fb-b1e0-d78c29cdd5f2", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17709478-f098-42e8-8f33-a88d760412ce", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ade2284-9b5f-4311-94ca-149222d7cd0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2bced52-0b13-4db3-9dd7-b2503bc9c50d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd99f6a8-b9da-43a8-9229-5b7f42d00d9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f6a7e06-ab1b-43ac-9ac9-163267d04988", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccbce877-4895-4aaa-9516-b201d3511ea5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89183129-2e4f-430e-b5cb-8d053d5e2e7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b2f4734-9d51-415c-878a-da0a825e419f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ac4425c-be9b-4375-812d-615c064350e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d19322e4-3e64-4d7a-b73b-587e2ca74be0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1a25654-0f72-4a3a-b30a-b2144351ea34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83f95abd-c494-4891-b7fc-391aee505de5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dcfe364-c59d-400f-ae22-f1879191f2a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef15f606-a70e-4260-b316-d366ad6c26ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29bc38e2-d2cb-4ce9-864c-2677fc780475", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c0ac34f-58a2-4d2a-9500-2f70f963de92", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5aa93f5-2a3c-4eb0-b707-150db758bd41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e19cfde-ebf9-424e-a0e4-eb8f79af2f1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9911486c-3d1c-4722-9555-0a07687ae254", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec4a21f6-0da4-4004-a516-9882b85e755a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a884058e-eaeb-4c8b-989a-7d13d7674d2f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf7fbe6-1840-4a69-adc4-82a50c9f91ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd8957ab-1ccd-4d21-80da-ebacd511624c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4225f20-6979-42ee-a6a9-64fc67e28ec6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--779edc97-955d-4d4f-af9e-04afe813eb8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4822f15-6f83-49b0-8dfb-41df769c2102", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0391de28-a8ff-495c-88a5-db0132e52434", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--267ce3a9-83f1-49d6-8777-e767d22a951e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b87a4cb-7cfc-40be-b2fa-fd221fe9ccee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--734d556b-8e4e-4cde-a58c-3c77c6d0475f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adab0738-3e4e-4650-80ca-b035cda88252", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee48b32d-4e6a-49f9-b07d-e7d2ed24e9f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ccc02bb-8dea-4ede-b56b-e8f3d5777472", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fd0bdb7-f444-4374-93c0-a17012d80168", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e30e53-24ef-4336-b407-74c0b976f19a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--439eef4b-e066-45e9-8b25-4a8e850aafb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66bd4f51-95ca-42b0-b758-f91331a57537", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f4b261d-af39-45db-8745-ed2ce329d15c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--798ad6fb-5c35-4975-b0e1-948861f0d6cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad791280-14b5-42ea-9a66-00218fe9671a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e04597de-47b5-47f0-b34b-c07a4771c17d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dc87efd-343a-444f-a566-973b6eb13cb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e3cc8f5-85a1-4501-8f01-56c74f79ccd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd83fa24-6cfe-45da-bbd3-e2e86ba5e3c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa7d7aff-e201-4118-aa24-2df9162a71d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14576803-d759-496f-a0c5-1d7e4cd021e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d34bb329-1bd4-4b15-8de9-f0feb307aff4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bb43a57-e6fe-482a-b73d-63f75bc52f1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65bbe776-f49a-43e7-9ea1-28588f204bb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7988d4d-f228-4579-a6b5-4f84e45cf14b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82613d4f-1f49-4bf4-a1a6-e7452b14f109", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ca4d186-3234-404c-8525-b5607e5574cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--954262a7-84b7-43a2-abaa-73d9ecebb270", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ede2c2b-ab87-449b-bdc1-e2915e307357", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d999288-c975-4d32-99fc-c384a6bec229", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e99768e-0653-4d98-a554-59d7aa5ef99f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76e46e77-90d5-403d-b468-127c36d46236", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f11f8c2-35cc-4e46-af5a-b5e62d56b91d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9d2b7f5-5938-42ea-bd6f-9a744049af39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cfa585b-321b-4af2-ab7e-df81edbb1dd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b36f8f84-f663-426c-a31a-536c4f259f69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d126baaf-4781-4d65-ae1a-104efcb732bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cb6c975-4db8-4a4e-8034-7d926396fc3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0c7d2eb-1eda-429e-9c1f-e258a18830bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbe8a3a7-9084-4f98-8d27-8aab28cf30b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca47c1e2-38d7-4263-a241-97dc9c5aedfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b1c70bd-9e42-4655-857e-2afa639272bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d50afbd-b550-4f1f-ac4e-a61f66672ea4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a429d03-0b29-438e-84fe-e84479d34c3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e3cc3b6-26c2-49c0-a29f-9ddfae5ec3ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1e0b10a-b0fa-482c-b0d9-82767cca3e03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a476f6f0-0b7f-445c-b06b-8801736dbda1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61bfb8e6-2070-4f2d-8662-cd953c211dae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--200f3ae3-d9d3-4aea-aa74-a567feb1d634", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4c56c55-3311-412a-98a4-7d73baea43ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3be5cecb-bc00-4187-950a-82dfa93d0f6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10c5ccbd-548b-4130-8d6c-ce17f9c11d47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce00181e-87f1-4e91-964a-e139e3710fe4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a7eccad-7cf6-46d4-b000-6e01b061e07c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ddf6b86-459d-42a8-bff5-3ebfa8cb398e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--915a4e7b-dcdd-4da9-b2e9-bf84421ef0a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb21b649-a7b8-48bb-9232-8f5f03ea6e07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--931b8026-0d20-44a0-9c8f-87ae50ce613a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d7ecbf7-1b51-446d-b754-be3e2835ade4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9b5bbfa-4018-4a96-9903-888043d95c33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eeec22f-a82b-4d29-9ee3-cd949008603a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c256511-fa23-4347-b1b8-48ebba1d95ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--471853e0-8ef1-4964-ab50-ddde93b37e08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60a615d6-4f8a-42d4-b99d-4178a46ab336", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--265b1885-e40c-4081-91c5-b69993e92f0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b25eb756-ccb9-44f6-9d47-55cb248c59f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4375773-6c2e-4d39-a4dd-390d791970d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee488c39-c694-4651-9611-3ccd1690a3dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e49afb15-e5de-4f2d-8483-9e0ea68693bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.239.55.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5445324-d4ed-4ce2-ad80-5dc087337cd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.245.111.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60eb5c03-e3b8-4f60-86c5-d0ada6626f31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.250.79.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c8e215f-51da-44cf-8cc1-56590fbaf4d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.88.211.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aa21bd5-052e-49e0-bd23-f193b060f88a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.88.211.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d7718c3-dd52-427e-b84a-072b0f1b903b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.96.139.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebe51895-2cf8-444f-8537-a3f9da8dac4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.188.187.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f268aa0-b560-4bcc-bdcf-2a093d8b0379", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.235.217.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22d75418-ce2a-49b0-9901-4e0e1ab40d09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.232.27.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e161f4b-7578-4816-9423-3fd292385516", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.235.16.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81892b3f-71e1-4c21-949d-a1a47c01d1ae", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.248.34.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aabafc9f-5326-4724-9661-ade18a636e23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.3.220.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccbe9c8a-6192-476e-8bd9-e56ed8d29d10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.11.177.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa05d5c8-75d3-419e-90a4-743f727e9cb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.12.73.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4131ddb7-1d19-4996-962d-a48c4bf76350", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.163.207.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d605cd47-cb52-483f-aa0b-79788f63016a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.20.127.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f72bb79-e95f-4e16-b918-fa61ebace168", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.232.6.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76304ec7-ce4a-4a9b-a4c7-c491d916c7ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--538a1e88-fd78-4f20-aa3a-35116e075118", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25a1777a-3f75-409d-8a73-62084030117a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17dd7f64-0527-4c63-8a58-2a3d0e6ffede", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88b9ab2c-b263-4bf9-8ddd-f481bec676e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99ff9277-9a92-4bf9-a6f8-9386e426cfe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c111d3-b71d-40e1-91fc-09ed6a84b3c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9252202e-27e4-4a92-a395-cc56445ef4cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--024da3a7-712f-4cdf-8992-638281a3ec0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31c11d20-6927-43ae-a976-e96a7490d58d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c14337f7-9246-43a1-bb21-bfc4196d92be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bd686b1-4c82-4c37-bcaf-809c89cfd4b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b10814f-ba8a-4cbb-ad54-ca0820e9ffb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92938da9-c1b8-4803-8f6d-1b41756da574", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14d1da2c-1eff-46c2-a040-e7b35a29f3ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--469a544f-f0d8-4fa6-ad4f-11b9958098d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e432c6b2-8c39-411d-b211-b5b19054195f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2061ca57-bb6f-4342-a5cf-2533b0dec6b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fb45842-a5b2-44d6-8ed3-018e39150d8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d2781f0-354b-4d9b-a9ad-3e5be295d94f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdd18eac-755f-400f-b0af-c73cc4e30688", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e73920e-e125-40e4-90f2-f7ec8d38448c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1754a0b3-8bb4-464a-bc72-20d31137662b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f3c18a8-aeb2-4a16-81d3-e7803842ddae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40a42462-a98f-469b-9fab-5c21c0075841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba9dcc80-099f-43cb-92f4-8d6f4f28e1d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28c2127c-1f5c-405f-a4bf-47dae713ab11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df79293-5479-478e-b587-64090f85de03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee0155d3-76b2-4103-bffc-52863d92925f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a75ed65-4475-446d-b72b-09688d4d59dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd98c88e-425f-4ac9-b203-0450db7f0cc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--743a3b69-35a2-4ddc-8e07-c5b6c3da95bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e147dfdd-6f6b-49ff-8e15-9c9bbf10c804", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e72a99ec-8345-43cf-9ee5-75d5a0303d8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee308c71-94de-4fcd-b205-31f65a1e9228", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b4dc204-8752-4085-b3b8-90bacdfe6753", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6115ae76-fbfa-4502-a3cf-6796314b3c27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07d01e43-ddc6-4c77-b8f3-7e66b04233aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eaa5971-e73a-4f9b-877d-5d99f0052202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c8dd546-e770-43ba-91df-958ff8c1a742", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b2dfa4f-4826-42ea-a1ac-666c7b7704b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29954cd-ba73-49b8-9deb-959f9420fa8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81794924-431a-4070-a2d5-4394d8959da0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1a232b0-5e44-44cf-b9f6-0dd7d78894ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55294db6-02b8-4f7d-b366-35f08530c233", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcf2122d-10ed-4ae7-95aa-506ee8db50c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--836747cf-84d0-4007-b81b-f6e09c6c5640", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70436c60-a6db-447c-b7f0-40353be35cbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6182bc7e-4e4c-4cd3-a18d-e40cefcf3e46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3d7fce1-62db-4f0e-a7fc-d57013bb7272", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbda1ba3-262d-4002-a89c-11d9ca10a8c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b57af03c-bab9-4859-b538-67491a68f55b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--224e9f78-b323-483c-89ef-6b345edf770e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36d9a322-082e-4740-ac17-bec307c4284e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--952da9dc-96e1-4a70-821b-e94df9691683", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8ce1e43-ae69-46a3-b11e-3af36f5b32a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30e70771-f6fd-45da-a8ff-8f6a880f2943", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6789107-c0ed-48cc-8691-f290d2965225", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--867b7911-2cd5-4dc2-9e99-0e858479c4c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a17230af-3188-4a47-a41d-7a3c15c49707", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ff25973-13aa-4f71-b8a4-0c14c5761904", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a758c7c-9a13-4be7-924a-22d7d8848ab1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d88d000-e5cb-40ce-90cf-0640d85e01ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80cac1d0-1fcc-4f06-8b6b-8a5e80d9792b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cdc88a9-22ed-4afe-80f6-e18fb3377f43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b52687b6-1704-4f65-90f9-069b61c94b9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d969ef0-2a07-470e-8258-a0a1780fbfbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d97e5012-c509-4705-9a43-3bdb046c6f14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--505de3eb-b233-4059-a4dd-27752039742a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--442ca244-8dd0-4782-ac03-bc1bfe81922c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b2bca7e-d385-4f08-9d2e-51dc1ddc8bd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f22ce72-2f06-4601-b21d-eec41f64421b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89bf2572-66ea-4586-a311-cd4bbc249a28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec2c2fda-44f4-48ed-b6bc-d01e3f4aa85b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6205fd59-0da8-48c0-920e-c22879b9c433", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac44754e-e6b3-4731-8595-36c7bbd20b56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eacd8dc-e4d7-4ac3-bce8-d172df2f8925", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e996ff6-f2d3-4133-af57-f44059081e28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19174e8c-6522-4386-8838-e3ae2300ee4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--133a6e1d-eb2f-4cdb-8691-35a61fc6c191", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8a7be94-64db-4952-a010-a48bd1527421", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--942d159c-625f-4b2f-8779-f93005d6d95c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8aada716-f625-4379-b62e-8ab48b327b7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ea03b9d-8a8b-48ad-82d1-d8886010e322", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4a4164e-8f04-4461-a64c-fd72d0916490", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4c30776-00fc-4cd9-bc7a-9b02fc7773f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a53ea11f-361e-4dfd-90be-5edf4d8e6d44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cbd5cc5-4ca4-463d-9855-7274eabeadb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d3a3608-9051-436d-b4b9-987b7930c540", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee10bea-c48f-40bb-b870-566a975b4dad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbd97549-ed9d-44a3-afd9-243e7138ab9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3fdaeb1-9b8a-4ca9-8aba-f11918d8f6a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a7e0d27-5396-4225-bc4d-ef71693ab32c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13ebfe83-8679-4af3-8d34-6bb43a9b2ac0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--652d4839-c7ee-4617-a836-a31274e34779", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31959d21-cd7c-4038-82f6-df697c80e5a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67c73a33-e4fc-40bc-8cad-45bb8b0a405f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21ebf07a-4385-4e9c-9ac2-8c60056ded37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d732bb29-9081-4b97-9d69-fed2382dc125", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--932216b2-c77a-4d18-95c6-e322a6c5863f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aa44c85-cfd0-4187-8f9a-17b43272213d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.38.91.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64aeb511-9eb9-4d79-b7ce-71e083674aa9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.46.138.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98f63de0-59a7-4161-83a6-bd434e80b350", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.50.239.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0648c262-9556-4233-98e1-0ae85169493d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.50.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3c4f388-75a0-4fd5-b823-18429d2bcd93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.56.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ed6bdf8-96f8-4c6f-9a08-4f28747ca2be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.58.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e615c7f-436d-4335-9b98-c6beab703239", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.98.52.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79ff1dd5-471c-4c84-b17f-5a4fa3a0c6ba", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.98.55.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2156a569-9174-4e28-82d6-7c5a2352150d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.127.60.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25c948b1-9371-46c3-b1c9-7f88107f0cef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.30.231.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c31395e-8b83-4209-a6f6-784282912f0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51043921-cc58-45d3-979f-7c8d391d2110", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afe89360-c253-4306-88b6-3d1f18c1bfc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af596983-51df-4d8a-a4b8-2633e25ca9b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2a99b2-0e34-4291-9a83-29e44f91443f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7cb1bb7-66be-42c9-906b-93275089717c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c074c711-c1b0-4927-9473-0fb5fd8f41bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5da8f85-afb7-462b-8caf-e75289401278", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b4509b1-fd59-4e91-8375-01ff4127836e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7386a67d-291e-441b-973a-79dcdd79f860", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4afd5ec3-a568-4284-add7-b557923ecca5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39ffd6fd-d757-4ac5-b915-9aab7afb51a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc579aa1-d648-47ce-9504-848c9b60f8eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0f543fc-1f1e-4e18-8cea-2ab412ed64eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6d450fa-0751-46c9-8d39-885912edfbfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd5b1c84-7577-4dbd-8a13-bce1e078d7b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f93ff5e5-2b2a-427c-aafa-8aba877a6c95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e45e42ca-27cb-4997-aefc-501610faf764", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f57e1028-1669-4723-bb32-7bc8f0b2dde0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--188fbe55-9004-492e-8170-af76e4c6e18c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5617d4b-43c2-407b-a222-7824976cb1a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fce43e3-7735-49ed-972a-d6fc1c74af84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cf60c68-4210-43e1-810b-09458014f2fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01644201-5b15-4a00-be37-c3840a804209", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.26.62.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7872b1b-5385-4873-b2f7-d337cd2dee69", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.27.55.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff4ebc78-c9f0-46ba-9c91-767f692bd783", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e0d61c6-2bd4-4f9d-bf09-6dd4e438f5f4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9fca2b0-84d4-4c9c-8b3b-1dd87ab9bd62", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c48f78a4-e5e3-4da0-a986-4dda67eab0de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.63.211.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91b79aa1-d429-458f-b06f-c03516712eca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.91.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b26c99b-b995-4328-bbc2-3ae5ed020fa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.92.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6cf857b-4792-4a47-a6cb-abaaa48aaee1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.92.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b716fbf-eb03-4863-ab58-fa80a933255e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.115.56.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85e1bade-3bef-4b88-bd67-4f0efb8290d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.115.90.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bc01751-3fe4-4c97-a8ac-e022fafd05c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.201.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99d17507-eaca-4f01-b6fc-f840004ec010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.209.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2731b9a-6ab2-4b12-a4d0-012695852db2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.225.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb74b31f-9b56-433c-9724-834308f2f0ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.32.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce9738ad-ae66-43d7-828a-06e9a5d71d55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.12.240.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c544f2-1950-41a3-8432-b8b12c604a2d", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.124.80.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6173a51-6fbb-4587-9929-79d54d4a362c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.155.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b703334-06e1-4edc-a114-a45d005e5b5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.173.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--447cd953-8976-43da-82c9-75351dcea670", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.73.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--595de877-702a-4e35-9b3e-aaeeef12bc6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.73.63']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e13448a3-906c-45ae-a859-40ffe552e958", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.74.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--708ca607-bd57-4e47-b5be-ba8b26a6ff69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.79.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79b8183b-f2fb-41b7-8a73-2f01ef57fc64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.82.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e72a5e5-0b59-40ae-9e12-de6fdb2fe7e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.89.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7a82141-2041-4f4a-9d61-5c20cc271bdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.95.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--601160bf-66f6-4911-8628-5d544ca7d636", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.162.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8307aaf5-8af3-4321-9bbc-b977c0103b42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.164.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02f4a236-c0f1-4d81-8cee-58acbd0727bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.164.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5794cf87-7b4e-439c-ab82-59bff4e6ce6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.164.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a41cbb6-dd6b-4c3a-8849-671ee8afe320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.224.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ac7521d-4775-496f-889a-1ad8c5d84aef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.150.192.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57207e62-a36d-4979-9e3c-2de20f73ca90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.150.193.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5658fdd2-6a41-4625-a8f0-5f0c39f7c4d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.14.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b76bfca2-882d-48c4-9df2-c6baab612ba3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.14.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9be6cd2-295d-45b4-85fe-fb236959247b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e3fd61a-46bb-4aaf-a985-833fe921d9c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3908264f-31c9-4449-8918-352c0e03b1eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--684463e8-237c-4f2f-be2e-c57fefb848a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--760b2c21-147d-4f9f-858f-10a7c724cb04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bdf10f7-8d97-4428-998f-ef8699652efb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.16.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba2e87c6-0f15-43ff-b6a2-db791a9a2d86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.16.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fca12c00-50e2-4f40-b080-b78856a1e5b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.2.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c43c05a-cac2-49f2-95c9-ca77f5c45b89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.27.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71168f56-c5dc-421f-a3d5-ce12284066d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.33.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2edebc2a-6e1c-4de9-ae9c-871cd4f3c751", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.5.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5fa65a2-769a-4ee2-bd93-fd2018edeebe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.74.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95cb27a5-6102-49ee-8e39-edc47632fed1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ff70d0e-e6fe-4981-8beb-4b39b75c5f2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--265def3a-894b-4dc4-8a0a-f872420c2a39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--162bb02c-7f72-40ce-9925-68e8d69354a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.1.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45956697-0644-4a7d-b802-0d125cb470d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.116.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3a5c8e5-e481-496b-9011-dd714f48aabe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.12.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75098ab1-8c3c-43ba-9aa0-5ea7b7325789", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--103a6800-d3aa-4fc2-98a0-36ffe182d311", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49b814c2-12b8-4fb9-ba18-b090fb95a9d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f201b28b-6c87-4554-8b4b-462ff743331d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cab6e12-3a6a-4966-9ad9-713817d7134c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31cf870a-3e13-4bc2-81d0-75756e6bf083", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53d1ee96-9d90-4da5-923a-94ea38cd1959", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab9890eb-bb62-4d2b-892d-a50560276fe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a908a25e-3f21-473d-8999-30676c7e4b91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.127.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26533069-763a-447d-8a0c-eb574150c657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.5.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08ebf3e7-fe0f-4f5f-acf9-4d088a0cc63b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1e99c7e-47c1-4ba9-a78b-25c61cf6cb83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5ecb944-a9cb-4fb2-80fa-0480b50095e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c1f08c0-ad56-41b8-8a1e-9c1fedd6c824", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ed1274b-df27-4899-8b08-c92f526a2a8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2946127e-43d9-4b80-aff1-be6aa86e995c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55fdcb5c-0b34-4d6e-be8b-b94c6389da3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.8.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba75d95a-1d1b-457b-b364-a8451568f21a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.104.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2184bdea-251b-4f7b-af07-58e37bc4d16d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.104.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f6305b-8935-40ce-9724-826d95a7cc9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.104.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08d1795e-8ff6-4635-8b36-793c2a3f801e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.104.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51352634-0cdd-48d3-8f45-a776e77d34dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3da8b0a6-d815-4317-81e3-c7db41150c24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e5e20a4-056b-443f-92c1-0f9a10ad906e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8099e89f-3b9e-4cc0-890c-bdbcfbd588d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.106.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92c96067-1ed9-4122-b8c7-e87e33cac97d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.106.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04609238-aa44-473e-933d-ebef6f6e4111", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.106.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a404da52-9e61-4b30-b832-b975d8d2932e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29e337a6-49c7-45cf-8e36-7056c745a245", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.48.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99139760-42f5-46c3-9536-91ea6c415bf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.49.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70d43237-9360-4c3f-b063-a8f089249ed8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.49.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--470f74dd-751a-4aa5-883b-8b55e1c5b0a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.85.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bec9308-fe24-4b1b-a4e7-85383bf6b091", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.91.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75a27cf5-7db0-4dda-a5dc-a771a3a7e714", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30aea0e0-7efd-4988-a742-ca47023af04d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68e3b520-2601-4a3c-a8f6-40952fbc4a77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11399f88-8f3b-4ed7-a473-171552ddf656", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.203.42.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2a65fe9-25bf-4422-b9a2-ee503104985c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.220.220.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9233dff7-84ed-4286-bd0b-6bfceeea55d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.56.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54ac013a-3cff-4d16-9d23-73dd34219a87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.58.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec6697c9-b850-45e9-a173-40ac03e50bfc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.226.12.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f57e7a05-d6ff-4d95-a1ff-c9ced9e8d45a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.226.60.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffe14fe9-9718-4f86-add2-afffa5535c94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.19.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76097a75-8a4d-4f19-ae98-762394ccdc2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.21.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf9fe11d-e348-40fb-8b67-d7bc25a33fd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.24.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e06f3e34-bfdd-4ceb-8879-5cf7b44827d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.49.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08fd0e5f-92f4-4f18-8a4d-2777eddefea9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.49.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3a27cf3-9e1b-4cda-9321-3c839a98e2bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.56.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c237045-1f92-4c8e-b065-c76d8001919c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.57.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d12d45e-1c8f-4e46-abfc-612bd0553d46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.37.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b7a22d6-c2cc-41e7-9720-89044ca3e0b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.40.218.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c163643-df1a-44fe-bebe-4a7abe53bcc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.42.92.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--400de7a5-9a62-4a30-a2d2-5c342db71660", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.228.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32d61a2d-1c0c-480e-bcec-520f331a7e32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.235.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00495f08-a8b0-47e1-91b1-c74e6ef3d4ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.235.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba734a18-53f3-427f-9baa-42f13d7b5ed9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.246.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8748dae-61d8-40e5-96bf-4cdd6445273a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.88.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5f4c064-9de2-4b97-856a-b4ac79cb37ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.62.193.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f4aa4b3-194a-411c-be9c-dfb0a173d50d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e46c048-e1e7-4165-aa03-759278aa5f18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1868720e-d1ff-47cc-99b5-17aeb32d7423", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09e0b591-ff03-4909-b7db-db91ee5495ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a656a3-5ad7-410a-98f7-f20cc3c42d31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c693e50-3748-4d22-aaee-38147331a454", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8b71201-4734-4273-9d2a-df2ff5975348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f89a6d9-9952-4e4d-bd49-fd65e7dc4bb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81e595f3-1605-41e4-9a8e-44b42680d299", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b3d916-0550-49a1-938b-771808335e7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1a4d79e-1a72-4423-a6d1-1e56a0c9790d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1bba601-2540-4739-81ee-b20d5fbd7324", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe8ae3b2-bf15-4eb2-be19-1bf4ded41d15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66c38275-973f-4772-932a-f2e4d7c8e813", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--451572af-645c-44b4-8ab0-dd67b3fd39f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.138.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2747714-774a-4c33-834f-0e1f817b6d20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.138.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5c36ee9-eadd-4e65-bd7c-78a5d05b349a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.145.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bfd11d6-2a2b-4e7f-a92b-4dff323ef3bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.154.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f735b2d0-e4d6-4da6-8568-0db5388bb5a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.154.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f004378-486e-45f8-922f-de92bc6a2755", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.154.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b51093e1-07c6-4b43-b2fc-ab4c3f7f00e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.177.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7721272a-3a95-433b-ade2-5cf94855b5c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.184.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa29fcfb-2dd3-4de0-ae7e-cfd0802d6b34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.192.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7e2d7d3-15e7-4dec-b0c0-eb58d7818467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.192.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a7f8d6-6986-4433-9f13-7a0d53b64ae5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d457c9d-8b00-4b0f-80d4-6a7baa27eb7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1df02a47-8ee8-427d-9768-1360d290261c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--874a1c99-821c-4461-936d-dd913f48c927", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5876851e-a428-4eeb-818f-c74a88a20888", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--717d0d8e-4069-492d-8e86-649f0feee69a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.255']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc3060a1-eb0d-41f0-9902-96f609d9b4b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aac52e3-13b3-41a5-9130-68c414af2f6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3504109-ad26-476d-8e17-761bda99ad1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98d43f90-b8a8-4103-96c8-9ca061a2ded0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12843008-1f4d-4ac1-bd96-31f1bfac05a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb0735ef-4fd9-497a-85d0-e226546b946d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fd3aa56-da98-4813-a138-f887095bb9c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46bf6893-79fd-4cc1-ab59-b358aa520219", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4d75952-ecb7-4c43-9233-635c672d95d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e10d716-cc60-4e3d-9b81-61b88df26691", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d461defa-4bd9-465b-966a-d5f552960f4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0094b14b-6370-4bff-81b8-282e05236d7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2de06874-a169-48bb-9257-504b73126737", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03a571ca-f79f-4517-a16a-0595ac5fc92f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ae9a950-5285-4fd5-8820-b07acc731f2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e783fdc-0ce8-41fb-bb63-9b661b80ae98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c1ceecc-db8c-46b0-846e-adc9b9a704ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f202469a-ce1d-4e98-8ad9-5b8d10dbc6e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d5b47eb-481d-464b-b22b-06923dbba825", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.72.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b1f3489-cec6-4a0c-a66a-eb68f9373b0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.88.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7961dab-f884-4711-a54b-cba40323de15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.81.47.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee5feef8-3d6b-4c69-852b-5242202b34f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.81.47.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6835b770-2e02-4605-a3a1-063de12e4247", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.167.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--088948b2-d9b8-4393-8cd3-4d7bbeedf422", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.27.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2824593-d52d-4e4c-962e-09c7d3fe6bbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.27.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1af2f7ed-8c92-46fb-98c2-f216e499a160", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.48.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef778ed2-cf5f-484f-80ee-9eb86c61fe3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.145.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3644c0b4-a1ca-4436-98c2-03e503bac5ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.153.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--574b45d9-4958-424e-8bc5-40cf4800f151", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.153.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--174f985c-6c9d-447b-866e-0bdc1da2f8be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.166.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efdb2e2b-d40b-409a-9678-8ad574649542", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.128.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f589726-5a5b-4672-9cb8-72b32b54652e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.152.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae9b9f38-d83f-4de0-b279-d4f3a5207b78", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.105.172.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0c560aa-44a1-484e-968f-5c512b1a7b1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.56.131.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffc2be34-b665-40bb-97ce-6c4918535708", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.92.209.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f65bcfb-c9ae-4a81-9118-37e2c38138de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.123.175.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--773c6038-70f0-457b-8e95-03c51e001975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.140.123.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a3af906-f8d8-4de7-b477-15828fb3d0b7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.186.40.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d5e60c0-ee04-404d-a3b9-9e65cf22475d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.112.47.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--855815a6-9aa7-45ac-a635-d995c536b604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.125.94.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7e74532-838f-408b-8a1d-62e5dcadd693", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.145.0.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2729bed-8f5d-4932-b0e9-7d80e8f1c4a1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.76.174.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--152d3303-77bf-430c-a2e7-99d37800a8c1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.83.16.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5edad2c-6075-460d-934d-5aede25d8072", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.88.222.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72c4a1e9-afa2-417d-96c2-0e03216548c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.9.123.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01d21be1-3213-4607-854a-41953bb8b003", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.150.107.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bd41191-37de-4481-8427-188ae3c39a25", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.155.253.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--755b6777-4628-4854-b837-5f1bad0c1b1c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.175.74.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32d96c35-1b0d-4411-9707-62894b82fe63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.188.183.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b22aa06-97fe-4e9b-becc-195ac8bd7643", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.23.128.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d0e7287-72fb-43b8-94f7-af1f4a2c4e80", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.23.199.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21b10ed3-7122-4445-a133-838e373054a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.55.131.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bd2c366-6134-4a5a-9b9d-d8e7077ed713", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.55.131.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44a5cda5-db54-4169-bd26-2d9dc140bb6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.55.131.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67a305d9-37ec-481c-b516-b20f817000fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.6.235.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae0e897d-48f7-45d4-8e5b-6452c09efed1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.83.234.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--742372ac-2778-4ddd-8499-bb7a537aefaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.83.239.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba35d60c-a6f7-49eb-8529-30d40026497c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecbf78fb-fa6d-4d88-b34e-e77334a3cc3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0fd1ce2-cc37-462c-a3c2-faacbe5d0e25", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.93.246.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94459b43-ccb7-47ba-9f7d-5dcf71a58fbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17af9369-a686-4645-a9da-aec4038b2e85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00c65003-c2a6-4e6c-87d4-48a2f1188882", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6035e22d-3b74-4e38-896d-bed289e557f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5be2176c-90a9-481d-908a-adb2096bbcb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--684f0ea6-637b-418a-beae-cc99da36f18b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2e8efd4-a62d-495a-ac6b-b86744c61e3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef28f82a-5095-4dd2-a458-5447a2ceb95a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faf253db-7edb-4b9b-86fa-58887d5de0a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--308c10cf-80a2-4212-9d03-9adfbc4fdd61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7e82584-15f1-4ac7-bc61-5d47d33bb7a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1558409-4594-4276-9b15-5aa57b20da7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9812ce2-76da-46dd-a041-3ee4513d83b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa959cbe-b4c1-455d-b293-6ae87904837e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d680448c-d367-43f6-a764-c470138634f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36684a3f-0cd3-4622-b783-767b5d2c7d51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--631953f3-8c3a-4631-9f93-2a272aa70133", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49c964ff-e81c-4750-a96b-966264654c4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2c77a65-4a26-48f5-b8d4-7342c7f0de76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05c06e37-6278-4cfa-afcc-fa0222ccd079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54355444-6697-42bb-ac86-83fc02598dc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7773595-765b-4654-b3b8-9b35591c96e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b51a462-c5cf-469f-bee3-85e8242cc6f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f82912ef-3345-4879-a4dd-1cbbb2962240", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--400d71c0-3927-4d0f-b61d-c283d27c45e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4956a0b-ef58-4e59-aa07-48ef78202c72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b2ecd2c-2d80-4a95-8e0a-32b2ff5379f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7886c36-1917-419c-a046-4a23a073980f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aae07765-cbbd-4de5-bce8-779bf3769af3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c90aa33-2306-4972-ab48-01cabc72d13a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac014cf5-16f1-4455-b6e2-6add6d30e092", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48087d92-016b-4783-b6a4-08397744304d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--842192cf-9c72-4eb5-bf6d-413b9685427d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--931f23a3-1aa5-48a5-bdcc-cd82f9881936", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7be77acb-5b3b-4b07-9f9c-b7b82fc2f2fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39106b9b-f8d6-4631-ab1e-ccff2e5cea0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6423b586-f693-4072-90e0-8f08a0779013", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1486a36b-e12e-418d-ab3b-5c833f062f50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08f00c73-b2b0-44f7-b55a-c55d215e0dc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcaa74f6-f98b-4203-8845-82323646ea51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b35e9c7-a25f-4492-958d-edf5e65e119c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--832f2453-f643-4f26-9f08-908a6fe2fa95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f87a1172-1795-4267-b0e4-64cc16350038", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--995c48b0-bcb9-45d8-93d8-d807c48b3d90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b77ab62-05c4-46da-81f2-edb5ae1eefb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--020715c9-c655-4f63-8c3b-3a3b507abfd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de642dc4-ccb7-489d-a516-d24e77fadaaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c8a6405-391a-4020-bfce-a8be77fd9335", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b3a1bb4-12b4-441d-90c7-a805ddeeb538", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd2a7018-19a0-4ef9-9eb8-875bd5a27e25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dd14325-9d7b-4b4d-90c0-38fc488e988f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0c22f5-14d9-4787-b2c1-d8eecd9e5d62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9c4331f-435e-4996-b46d-d94f19c3972f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d86fb2be-a110-4745-baea-166e8cb9c6d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--035e55bc-4214-41ac-b5e6-e240f65697c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daa37928-71d3-403c-aeef-e4f742184144", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44fa56eb-bf58-41b0-9b88-6a12222d1d9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5977a814-ec7c-4208-85e2-1d892330bbc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf2d777-d887-4a79-978e-cd4d6c7ce4c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1f71ec5-0545-43e7-950d-15fd07acaefa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffa21e37-bf40-48e9-80be-eeda9cf68074", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9729caa2-c10f-462b-8daa-aef22868e814", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fb000a7-676d-420d-9a5e-c4eb6b89decf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--002f22bd-c7ff-4e8f-a780-21d8178ed4ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c606a0a-e1c8-43cb-95a0-93ca0f9c1a2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03ff045c-a6c9-483a-9699-183ac293da78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe804592-a23b-49a5-830a-5a9f363c3b91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--532b9f71-cc8b-40bc-955e-26f921fb040e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef2763cc-97cd-4410-b65c-af46d54edf6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--140bbdb2-80c0-4e16-a004-db6e053408d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f944c8e-9eae-49d9-abea-5082ff25d856", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fd0877c-aca4-47fa-b9aa-a9670932a912", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ae3fb15-97b0-477c-8903-ae0c70b53448", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af551427-55f6-48ec-9b5c-cfb98d1cd0b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--687ce4d7-be4c-4759-9695-27df379aa1a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdda9181-ec87-4c9c-b66f-af4f1a5d3833", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f61b5ec-650d-41f9-8f57-de7dfc7afc7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--374ecf16-8d16-4235-ac3d-4e0534a56e42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7df0f133-1b8f-4849-946c-0f8a57866eb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44d50467-d0cd-4b24-9854-7145adfca20b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c3c46d6-52d3-4c12-ae30-a8f289cf76cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b0e1724-887a-431b-bd9f-4f104082ed70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceef18b1-0d40-4c90-ae25-2158d2ec666c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2f2ae3d-a126-4ed6-a244-c2c6fd0208f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d98f4fd9-81ac-4800-a428-05dec8cca612", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e809a8e5-a4c9-46c6-943e-e8d083561655", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e07dbf5-c410-4c44-8a34-845002d055cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bb1dd72-5a34-4b27-98ab-d43b0162b200", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--414f3789-cce1-4e10-8505-8dd45c11326d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2d83dd-8c0e-4204-a91f-05425541a064", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--249f92c4-679b-4153-8d66-ea512dda48b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29ac7703-4d8b-41ed-af62-ae369c9540d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c685f1eb-962c-4828-81ee-b1c18bd94837", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.135.171.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf5384c-2ab2-4eb4-8403-12186343a466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.168.201.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c65ab2e1-67c8-452b-b975-75c259067e28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.100.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92215360-1da4-4671-ba41-c79346e2aa32", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.132.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e65c794a-ae93-41ca-9e94-0f5b720fefc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.140.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45e3e6e5-979b-478b-bb61-b791c66bb972", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.186.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--908696a8-f6f0-4aa9-946b-69eb3aabd139", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.226.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9442910b-7851-4ac5-8069-3ae4cf0a15fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.25.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3662ac1-5121-415e-a558-8e893713e045", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.58.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df135225-ac57-43bf-9927-6ae3a1513378", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.61.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4acbeabb-9f4f-41a9-a808-34086a068274", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.81.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a2b9ab1-bc3a-42d9-953f-8b12048239c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.212.244.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13dad937-047c-472e-a1ed-c0a4dff1fac6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.221.176.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbb9bd25-916b-4c10-bffa-b212b80ff4eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.221.176.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9712be0-3633-495d-96cf-bda5609ab740", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.223.228.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f1db832-f4fd-4153-948a-0e3c456dac10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.42.55.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--620f0ecd-d2e9-4ade-afa8-9422fe1ff144", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.81.16.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81d6c1ec-6f33-450a-a8b7-9318de6b8048", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.0.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--999edb17-d7eb-489a-a6c5-f546206f6355", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.44.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a4fde8f-b7e9-4dcd-96fe-97e21a762cc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.64.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4794e1e-3944-4c78-80d1-212776a23a89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.65.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--905672e7-447b-46bb-8724-ef4c82ac9521", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.246.106.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b601c3a6-3261-407f-941b-ba236974f762", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.56.9.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d128988-75d3-4a00-955b-47113c000e90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93f7e9c0-7831-4b89-8193-ceb03629fa65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f0ecb4f-5712-4d3a-ac70-61a9c7a21859", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5aa83de-073e-4a89-a1f3-fb7401baabd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--663af8e1-bc6c-4eb4-a2d5-b135c5c76cf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee4cd757-3de9-485c-a8bc-cbb41e62e5bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad43fb17-24bf-4369-b795-8bd39307dd9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0961a5b-4ebc-464f-94f0-06b5dc3e6698", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.109.189.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10db8fd3-4e56-4ed8-b8f5-f57d5ae517e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.115.214.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e71af332-ce63-4a51-bf85-37a5201f6b56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.241.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--375f69a7-a8ed-41af-b3c2-3715a35167c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.242.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ca96402-f27e-4c60-8e9e-013fbb20edb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.107.230.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b19a99de-908a-4f11-9010-9dd25ec37c2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.14.89.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a52c9b9b-d92e-438a-bfb6-53dad5f7eae2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.41.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15e92162-9cff-40e3-ab49-2eb7d0c90fe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.45.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e67181b8-4d8f-4949-99a9-71c970c352bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.46.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a92d298d-f9b3-4a07-b901-c07d0199aa5f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.47.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bb1d155-9520-4efa-a6bc-b9aec18d5cf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.57.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dc616ff-1e58-4894-8851-ed7249447430", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.182.233.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e66ebb35-6a69-4d29-9a84-1b90cfb7670b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.222.101.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c57303bf-4aeb-406f-bb0d-009f0f5e0203", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.111.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c027720-0c19-473a-bfaa-32786bacc21a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.20.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd8d98e4-9bce-4404-a0e2-e022aa55a1b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.227.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cda90b27-6475-4bea-a064-c83b383a4770", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.96.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dda9075b-a7e6-4d20-bc4a-fc7f66d217d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.99.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91342382-1ccb-4bbd-b007-4ff0c8e3c897", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61c07d4c-22e3-4443-9e7c-8ea7188d4ac3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4553e94-533e-40da-bbeb-a75d83cf501c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6aeb4336-0553-41a5-ae07-e62534a2b4c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77291333-fc58-4d82-afff-0f2e96e78f62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f05001d9-597a-4b3c-b79e-f130b3238600", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3975f879-491c-4756-9c4d-e5a320e375d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e1964b-ada0-4813-a9e0-7b29d55d3f40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec716e90-38d5-4ff2-b9a2-c8ee8f7a4004", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a5466d5-87f8-45fa-878a-bbe332abd5fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--587ac5b9-0b3f-47fa-9cc5-23f6d037d760", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--103da721-c308-47e3-95a1-b16e5b4655d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43276ea9-c86b-4348-8e05-9046714c5b23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1c757d3-be30-4ce5-9034-a07d577af5de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00893f6f-4f00-493a-be2f-c071121e5602", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61154202-db27-4fdc-866b-2f93376c245c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16f0cedf-1841-49f6-885e-e01ac18d8d3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a8e4724-0004-42b1-bde7-5da87653ba7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6ac161c-ce48-4219-b40c-7fe70cad9684", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1fb2020-fc05-4e9d-82e2-ca05b06a89e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47dd33e6-3d47-4070-8d7f-4174f93c3275", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d83ca47-1e2a-4bdd-8d38-c3996ddbb0c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--040c33dc-6322-4915-9085-fe4054608845", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed5ed39a-6c8d-4830-9b2a-1b60f563bfc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e082af11-6777-4404-bb78-2468d0597034", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e70fb50-3348-4862-9221-627d00d497b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cb10c03-40b5-4297-9199-fe921841cdc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab62908e-75a7-437d-a702-0c7528a88f79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d058044-7ee5-4025-8e42-fd8d11825859", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7507df36-953d-4517-b8be-2173bad5335f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03079ca2-dce3-421f-bc2b-bee00e937e25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69f57dc8-5526-43b5-8629-ec55671bb4fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c49de0c-c6bd-454e-8b14-2dbe1f02c0b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d305282e-d3da-4df3-9f05-76849ff654dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7602242-9305-4694-9db8-5f41ed42d6ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1e05cbf-31e5-4128-98ca-3f77ebb33b2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d97c5df-ac70-4329-bd57-d43f62435b30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--056a4d54-487e-4bcf-a7f8-cc4c8f62a4c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76c78a86-078d-4bf4-b513-b8a17f644991", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4342a1f9-1eb0-454a-9444-a54ab025819a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--866a18eb-2a73-42cf-bf96-2a794b76ffd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4eb509b-0223-483f-9ca2-f43b5affccf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e67cfc48-6fca-4cca-a96b-86a8b3e2fafe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10977fc3-2747-4f6a-836e-c3e004c2dac1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b07a55-d3d2-4058-b53a-f36a12fac6ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd61784c-92d7-42fa-86d5-1910c8b75d0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--909f6f53-99bf-43f6-98be-016c476a3eee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01657ed2-6cf6-4c68-aa98-738a32d5cb6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77c783bd-e81f-4dde-ab3e-2e9a7a9491bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9903222d-952f-4470-84e7-4dfebaa87ec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5998a6c6-2fbb-4f29-ae38-eb0acfc26313", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdc0a510-d413-49ce-a704-42aea6b00f46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--126aaff3-97d6-4d2e-ac15-7a8dc8c8893c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7cb68a4-58e8-48f5-8dd8-bffe9b3ab7c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c29a2a78-f4bb-4909-bba0-d047ce58121f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3628a8c-8be6-48b7-915b-f544db8a430a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7767c590-2a0b-400c-93f9-d3bb975a2760", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2829c507-f8ea-44af-8e05-7f7bc2297a08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--393dbbaf-3fdc-4527-84ed-8cf4b0e55cf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8ed3ad2-cdd2-4f34-b39d-460d9a400b33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8990d8b9-fd01-430e-8bbc-340363a18d3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b17a679-1641-40f9-b7dd-401a274fdd3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2384ae1f-1686-44be-8c48-aa2bfd01e58e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--304db170-e13e-416b-aeda-a3b277de642a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df5b5d84-95b3-4514-8d49-038f9e8b9920", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--815c10b7-a83a-4f47-b192-fe7026a0763c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5be369af-fe8b-4b89-9454-45eba73ed26f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97809a8a-7649-4bb7-80d0-9c75d537cfd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e3c7433-9ffc-4be5-92d2-27ed35e989af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74497332-0a2c-49e0-a8f7-43ee9da4ca81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c7a3ddf-6337-446c-bde4-3aee90b6ace2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c21cb483-d1d6-4123-bfc8-65d7307864cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91ea8d3a-1847-4be7-8393-882e1b0b82d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d15da4f-fad5-4e74-b223-253d50ce3ffb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41b8d99a-881f-489e-8d37-5116356314bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--636128d8-1d53-40ae-8ae8-0ac1af75e6df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc8c968e-b7fe-429a-91cb-77c451811425", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31165e53-1009-488c-95bc-e25dc9e7d4b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bd6ecbe-4a09-42ef-b736-5aef8cdfe8a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4f84673-36b0-4e6f-b7d4-cec0b990eec2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce1fdd8e-86fa-4603-beab-74b9a0ed0bcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--799fe822-b7d2-495e-87ae-60f86ce944fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ee51661-fe12-40fd-ade9-0191c38723d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24f73ec7-188a-4e2b-bae6-e2eeb4234caf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e35f2aae-f167-4f95-9276-ebb7f1f01ba3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25c8557b-bb16-4ff3-a78d-3ee2db5b5d4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d43a275-53a4-488a-a9a3-352467b475ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ac6df8a-51f4-4db2-8d37-923fd3fac5f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57d75757-233f-45d3-8e39-149388986bb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dac31d16-1d04-4f83-abec-56245921b9dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b209939-0fd6-4c3d-ab38-a0ec475f8882", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab520c45-8ceb-4011-8034-8c8e1f5d8c2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4439337-3976-4217-b156-1d406bb67be8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--847bb2df-b256-4527-a6ce-f2dfa0c30f83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f6dde38-23dc-4a17-b6d8-4dc87e003ed9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d053e75-8360-4919-b951-edb670cd196e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be6860b3-ed1a-4d03-b047-a70428d04ff0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--062507bc-1ace-4e48-96a3-005c4e3cc3ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--182d9ee6-cdfd-4b30-9376-40a2ec3b272a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41f28da6-45e1-4578-85f0-b81440e61181", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0ce1592-3e41-42bf-b6f1-1cc61eba3eeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd279cba-de57-4994-b570-7c55561b1f89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--099acf1e-b775-43aa-9e31-75c79daa27aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1509d33e-ec50-401d-aa75-0b73b7cc4ef0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae18143a-634c-4f08-ac10-7c7d701870ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64fc23d3-6217-4778-9e93-b6191e74e7c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--606fb8ad-31d6-4eea-b223-d4c927b5c0f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffbfede9-dfe7-4d4f-9816-a2463bf35d17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddc06da4-be5b-45d9-abc5-cbf410bcff46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--661eab8d-e5ed-4b11-8ee0-ef115ae3b755", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf1788b0-e8bb-492c-aca8-370b661db8b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee755db0-93e1-47c1-9403-08085fcf4e18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd9e7afd-1edd-4cb1-bebe-b79fa6dc2d37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a50d900-2d94-4c9f-847f-8213bc61b01a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5abb1ee-8051-42c8-9504-4d7231298dfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31ac7ecb-fca8-4fec-a068-dfe66a8a6bda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b17ede0a-6cfe-41f1-a619-62a85c286456", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b319979-3e4f-4dfb-939d-527b93d021c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9328c104-05d6-48ea-b47d-bd0f06fb1dfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1ed58e1-ca13-46a5-89c0-9f99e3ce2fb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f490fa0-8c2d-40bd-874f-b636abb79b00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89a66b2f-9f33-406e-b9bc-0c53463d4cc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0c8411b-c4fb-4858-bf8d-5631e35c6e03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2da10ec-5a01-41ef-b6d1-f594d5900dad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8220c712-90d0-4e17-bccb-7b09db55e795", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b864809-c96d-4ad5-a76a-2da38ec893c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22f89fda-1348-479f-9e8c-7ce770b727e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--904d95f1-9d5b-4f25-aaa5-8eeefae7f7f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41bc485b-6584-401a-88dc-5ab2039c80da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10a97918-9848-4b67-997f-a4ecca265010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53e6ab4f-4786-447c-aef9-1e248a821a27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--223b35a6-997e-4d3c-850b-a777f5d73c16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--debc0d65-85e9-4541-9c0f-dc5e1d209d9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82903e31-2185-46c6-94a7-d56fa10fae57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b3d61f1-6ad5-407c-95ce-9bf576447296", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83765e87-9e22-4572-9dfd-238178f30c5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfe1c857-3671-4983-9f02-30de2f112bb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd037e31-ce15-42e7-81d5-bf994a46a2d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--955a8eb1-3861-4c1d-88c1-69a3c10e9ff4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f9d5936-c53a-4025-a609-35eae03243ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bd8244c-0906-4159-9cc9-9c24e8dade46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc27cdc1-c498-4d13-a63d-293456f53c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de6cb6a6-8a3c-4fdb-8bb9-0e7ab17a9127", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fe88b9d-0ad3-4717-8575-f8ead8613dc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1c64a3d-cdf9-4fb6-bfad-de1c979638eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4a12245-9252-4ef4-bcfd-01dfc10eca01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65d39d2b-b17a-4476-acef-701685e5eba6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6b0fedb-f69d-4b97-acdf-f0ffc04f2a24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c0ad9d3-b1f7-4003-bbe9-702229cd9bf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efb905f4-4a39-473c-9c58-e2c4a83a1556", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dfc8630-746b-47b6-8f6a-8020d25bea78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1624701-6d01-4cd8-8d10-1f29fea5e3ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18d7c7b0-5ea2-4781-8107-646f030d94f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db84952c-beed-4450-b065-995c0dd3efa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46e5135a-c1a3-4984-b173-45e787e93729", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b82a4cf-7e3e-42fb-b3c6-f73d86323cd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84480073-e4b6-422c-b5cd-2c06e3f65a65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--179cb8e3-3e54-40cf-b0d8-a9a8f86e1b55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ef0b2fc-f579-4fc4-9490-3b035d9bc693", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8c95538-c100-4440-a1ab-5ed94dfc89ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69a5b9ba-5d28-4928-9e6f-003aea8cf879", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--711e8bca-52ed-48ed-80ce-033bc0c8c30a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cde36fa2-3770-4ea3-9d15-4492d298b655", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc858485-7e6f-46b3-b70a-b3b45280b812", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1debc22a-1858-45f0-b5d8-f833b7c84e33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9648f6d-8076-44fc-901b-4aad029d20d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1f55893-6ef3-49c9-9d5d-fddcb137b6f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f874e69a-96a7-4e5a-bd94-9c34e6e4fe04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c891243-1843-49c7-9adf-96072479f22c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07644eb0-0589-4e88-b871-b35ce7b95439", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0614bccf-24ee-4339-93c1-4ef2324b19c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82f2b806-7578-4163-97fb-475b66f4b770", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1765ce23-cd57-4a56-bc6e-033253fe79b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48364318-b476-4315-9f59-0e288d32a4b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.255']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e7b58e4-2566-4234-b5db-206406e5d556", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45578eec-60f3-425f-86d5-d9b3d67d8521", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ba5f2c2-06ae-4b05-bbf2-6479186ab843", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1d7146d-adeb-4bba-88f9-78546eba5695", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b88a1536-455b-4a45-a2c3-17a1d28bdf0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9d5ebbf-6609-40ab-a56c-96d5489fd9e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8002ed4-6e81-4a86-8740-7597d4d67ca2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--312a31b5-8998-44e4-b5ad-5488e0933b5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a6f89cf-e39b-4e72-94ea-baa4f7d7f563", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac33089c-6a25-41ab-92c9-a564bb5a9d6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d40d247-970e-468f-ac19-b7f56c9f9b6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--706d663b-57f6-433e-b5f9-0d44ee8af4d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ed5b24d-8138-45fa-b6a4-847fc7523184", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6cd1acd-2ad4-445d-8cd8-ea20ab50da1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43ef79c6-7aa9-46aa-b0f8-d76e0a30cdca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b8cbf90-d25d-41b1-bfc0-868510d2abbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c556abb-6073-4f05-beff-b77c45425aa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bed0672f-e4b8-40f0-bf58-8f836d25ab89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48deb943-35b2-485e-83c8-04b687b78d9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f27f88d6-dc34-4cd5-96ab-fc595c16c713", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8899754-69fc-48aa-aa21-48b8c537795a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd4ae03e-83bd-49e0-a833-93adc3808ff5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--680cad84-1d1b-4bd9-893d-51fdabb3b5d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c36e657-739e-48af-a716-5871b0e35446", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ab3163a-3801-4310-9e39-e03a438a57eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--204cb8f4-2723-4a09-ae4e-ccfa420365e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--043ed3b3-67bb-4370-8b3d-44c6569e643a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d33952d3-3940-4b24-bb05-f52a8a4cfe9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--643fcf2c-00f2-4eda-92e9-5a107d67e1d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fd94ba3-7fbd-4366-8c6a-0333e0db5c7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5518b1a9-1a38-4a70-8fcd-5d8c4a09de62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89dd6114-ebc1-48b7-818e-151ca92739a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a666bf41-7c7c-407e-889b-c9cf144d0340", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b89bcdb-181b-4e3a-a754-3c4f87f231fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d479bd9-6d57-479e-985e-b331d433c6e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce4ffb07-e9a1-4523-a66f-c741e11d5f12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--962c05ae-0e40-40ad-85a9-698911138ab8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7545006-ecef-4b4d-bfdf-a28dcee9d221", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--140374d9-33fb-4c5e-bd25-a7092a07d5e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--685c0c8c-e261-42bd-b6b1-418b21fff88f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--978bcece-2b7f-4d99-bce9-87b9c67a0250", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c067ac97-3cb7-4905-ab35-c828ef6f6296", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.63']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--394c2aca-c333-40fb-b410-3d5fc72ec592", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11bc51a8-4966-4820-82fd-94f044463492", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81ae6ec6-b544-4759-88cc-de061302ded5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40a32556-5cb4-4bda-8b0f-55592b02fdf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ee8aa4f-693d-45cb-90e6-5d0f8bcd86bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a74fef4f-583a-4e6e-9aab-6c76c9250d63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8db37f79-8ffc-4038-8a9b-bb5884e7e7f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fca82fb-19e6-4eac-bd2a-09e8b76493d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc6651ee-bccc-4e08-b669-fd645cc2ae75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c265e18-afe0-4f62-834a-022ad3e4bca6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbac080d-e786-4876-9877-254cd133d965", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04f54752-4ba7-4dab-8ced-0fdcbb4f0e60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f54e851e-76e7-49ce-80cb-237a41269526", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dc0ae94-0b39-4757-aa35-80c22c15f40e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33fdb5a2-13be-48cb-85a2-4ffa6d6a49ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fc6dfa6-ba82-46ef-8ff6-3c8ef84b2d7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ab07142-4883-4e54-a385-564e2764d6b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6af22fd2-eb9a-46a1-b54e-b6c9057827ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--155eaa87-ff39-4ad9-ae53-50ade3615fa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffe5146a-db27-4964-b902-c01136f1c32b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f24c668-dacc-4a94-977a-c7bd146c705d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faa2e240-5cda-4cb0-a1dd-76d426245703", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00bf6d5a-3fac-490d-affe-392d48ae604a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--194e1896-b7cd-457c-8b3d-db8533fa67d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f910db9b-a2e6-4b17-84e3-bfc5097527f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91c0d789-2dfd-4f3d-8992-7515ca218f4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a05b81d9-07e1-4531-aa64-fdf0231cc739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ce3562b-a8cc-49cb-969e-843f93489314", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--433cad5d-5332-4ba7-adda-e68e51a48406", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b66c2f53-394b-4375-881d-406a96108ed6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d9f277b-a5fb-4b08-94d4-ad2b69001b61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--579601d0-4308-40d6-9484-75cbd9a58cf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a27c6d42-25c9-4dbb-be08-8419d3ec2dc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af938f69-0e14-4eb8-8a3a-15c86e5d3dcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--429e516e-12fe-4be5-afc7-e19a19323ab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38574826-2f00-4e3d-8f57-a1d7dfcc3690", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--640c7b41-5a43-498e-be20-c3cce5592384", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--accee324-2d93-400c-a58c-47efc9ef8a36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--700c4864-9ed8-4839-94dd-ef2f9fb587c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.61.8.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a267ce8-e2eb-4b50-a81f-b6b9b9215aae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.90.232.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46f3e91d-1544-43e4-9ee8-4708b242040a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.90.232.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb1fdc98-24be-4d2c-995d-05e98c00dc5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.97.179.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c90a2799-f2e6-4fef-990a-eced736a0410", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.184.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1c71282-0996-4d32-a6e4-76b10c60b96b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.206.8.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--549af79f-6f9c-43d5-98ba-f14f8897a6c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.210.155.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7895f21-23e7-41a9-b0ee-8624d6d2085e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.212.136.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b1ea4a9-8048-4bfd-bbf2-a1d3e94b6153", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.23.87.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--478116e8-c404-4512-80d2-5672b5e9a2ee", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.170.168.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7099a87a-ddca-4887-bc12-8c2c0f143bc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.180.105.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7792afcd-cad0-46f4-8242-3ef43247928f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.40.167.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68311695-1cf5-4b74-b8c6-f228a6294095", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.124.7.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f16ca8b5-f0be-4833-a372-5c836010e46a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.132.127.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d628ffab-98e9-4a30-ba14-8da0ec98d8d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.192.240.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa590076-b9f4-4941-8efc-63e3b7c7af1c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.227.246.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1772d0d7-4d0c-4fb4-a6bd-0977a54e365f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.60.80.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--711c64c0-926f-43e5-9617-677f32079ebb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.73.217.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3b96f95-8160-41a6-8a4b-5ec99179ab9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.80.7.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a988d67-59ab-4a54-91d0-4f4608d9c4c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d66360f-8dbe-4d11-8298-67385f859b4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--587c49bf-c632-469e-b3b0-6fa1f7e37e10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11605dbd-a0ff-4c65-8101-8f3f2bd71db8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c9e6d1-9af9-4293-9820-d8c94bbb3ffc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a7904a0-e888-44d0-b10a-438886db7918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb332111-0322-4c35-97a0-973bcb4a6896", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a38917a4-cf38-4c02-9b79-bb5683f1381e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df846e61-62f5-40c2-90a6-0fa738194c6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec801e03-dd8c-4247-905e-a3180d9af66d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb150aa3-ebc6-4297-b8e3-c31b0fd90d29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8fdb3c7-7bd5-4f8e-bc40-90caebc4ac72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--827b0b38-024a-4da7-b80c-a8a710bbfbc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bf1653c-1129-491f-9e76-592e683b1af6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--183d6721-0696-406b-b65e-056f34dff85e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18f53be7-d806-4f32-b3d4-a74cbc120696", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96960b86-c5cc-44df-ba10-1d8ae081a5b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04fd0e82-d2aa-481f-89ae-0be8c3f11225", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dba14906-0f09-4e0b-8922-21b64d3b23de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6116b777-d19f-40e6-b184-3959ba6c9fed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a1dbcde-7379-4b43-bda4-d1ee9b527497", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1de37b1-414f-4985-b975-a47e9524f2e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a16b9d13-2771-4e3c-8fa1-49a21d8fb21d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9232ecaa-a885-4ef4-a643-b6136078770a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20733880-5d59-47b8-bcb9-c180893b5395", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6f77e77-3814-4053-8515-f8060a84e00e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a78712b-44fd-4233-b1cb-0f02dee4075f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40ff10cf-7709-47c3-b392-0c95eccc1573", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10eaeee9-daa2-4154-9797-1c91b20c0eb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e4410a5-cb7f-4f01-bac2-6af204ea3f98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e87cf45-7c26-453a-87fa-910a016f4260", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8267e53f-c30e-4bf7-aad4-12f40f811472", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0858879-49c4-4102-b98e-4508b149e649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6837b6ae-c7c4-4048-a38a-788e81214b19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.218.160.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b5b6fa0-9ddb-4b62-a623-b030499cb31f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.155.93.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afa80e9e-9b90-4952-a492-4946453b2b55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a45683f-8245-4245-a7ae-6567b152ebf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d169904-66b6-4034-829a-19cb2ba9ce97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbffc567-7e59-4bc4-952f-4164ca1ddcc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--203d87af-fde1-4697-9e0f-9bf235f6a7cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb4ab240-27a6-493f-8fa3-fe978da8a5b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e371f7b-fb36-4397-9c9c-bd490b4f30ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98b2ec9d-9ee0-4d31-a47c-eebaff806a69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a96c15bd-7cd3-4742-a030-641c0700ec18", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d6bb78e-1bdb-4e50-bfcb-4e3d9250cfab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b73b69d6-4177-401c-8244-fb808f5246b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5363bdb-f64a-4ded-817a-5e78e8b3be31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--457d7b02-f786-4cd8-85b9-de82c274efb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3ff2985-0e21-4e4b-8470-7f3183490cb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97eca48c-6e8e-43ce-a466-7267c35d285e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cadf14c0-9b8b-4a77-808b-234ca71a50af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afc9ebc5-d3e3-4fc5-9203-f8c1db5074fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--134e36ff-61c7-4729-bcdd-fe5eb0a93bb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.238.93.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--955e2935-05d8-4600-9952-6c3677c212dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f835cb33-00a8-4c08-bba0-07d827a14c99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--904668ad-2f21-4f6c-a348-10effbb9ab04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba09fada-9cb4-46a9-ad98-a0b7581c7db5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0397b269-c4bf-4dce-9226-f1e4a4ff3faf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--007597bb-b73d-4ef3-b35b-4bc8c1c551f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb8c782a-f8c8-46d8-ae93-4f18963ddcf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a158d1b-323b-4826-9dd2-00b5b2251a34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e33380e-c49b-4a69-ac96-47e7fe23dc46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15c3992a-8177-4cb4-8816-d2810928beb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--602b7480-82b8-41a5-952c-bc499ed69c04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--193de47a-ee8c-477b-8aa9-cbfd1a9922a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f30f0b4b-50cc-4b20-8e09-3b744f39913c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3a8fe45-11f7-43f2-8c1a-8c6f03b77a7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f324f6b4-f763-45e4-929e-3e10b21998ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2825f36e-bac9-4215-8922-05aef63415df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1ba5031-9185-4cff-a855-b08ebb273942", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--891fdb4b-d7c8-4dcb-9dc9-c2a371b0811b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6981107c-61dd-410d-9fc4-07ac1c27bea0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5f2d7dc-b867-47db-87e2-471eb3fc2811", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7985fd7b-8a63-44e1-a952-92f5e069ee9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73816428-1c33-41f9-b882-b243fc6282ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--648acabb-8248-4d46-a8aa-b9845d449e2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68b5f93c-2539-4382-a8d9-eaacb651e955", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c50cf4f8-6a87-4d0f-9b4c-26780f5d0baa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2840a68-93cb-46bc-af01-d8de8dc31c58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45428f3c-b228-4010-9a48-de099604aab7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f3b0a57-cc63-499f-a478-50bbe49f36da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40e71f29-3d83-499a-8fc9-6856b7a4ec26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e82774e-c4f2-4cd0-92b2-77abe76b6fef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c90e45a-a8c0-4135-8927-8b949043283e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d02e005-de5e-4d1f-9677-e8eb513cec07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45e3aaaf-0910-4052-bc87-acd95d811141", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9df3e62c-c6e7-4672-8f8c-c2c36e1dffc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d575004-16dc-4c3a-b8f0-6327a7e4f6e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cf94b0e-8101-40b2-80db-cd904ba5150e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa1ec4a8-65d9-4e06-a652-a01202d249ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3dbb1fa-97ae-486c-bbcc-433d04e40a4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb3a3962-d6dd-4e11-bb19-0dccdc5bbe4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e8d3475-366b-46f4-8f57-42f682a129db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86ea7101-52fa-4fb6-a960-2e30c9f10a3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e05cfc98-50b9-4c3a-bc22-0dab632ab331", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36c42149-009b-4a8b-8426-8db9c3376a56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58b21579-647a-4f90-8de6-ae40b0615405", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ee8a7ad-7bc7-4d04-bf23-0d8eecf6972e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1819841e-572a-4df4-9de1-b0e849d00b3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a48bfc42-d82f-4e09-926a-84f6c18085e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e73d5c4f-9556-4ebd-a2d0-87a95b119b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.59.16.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--380a6f8d-3f96-496f-80b0-22e8fea823d6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--198f4ec3-27be-4399-ae6d-450a812372e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86cffa99-da43-43fd-b579-1f68349b205f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efd3a8e4-2e74-4090-8fc3-405acc7ba22b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.15.165.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9124630c-09d8-4478-865c-27b273aca551", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.154.106.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e329014-7d56-4b0f-896f-3760a8269807", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.154.38.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be195bdc-8465-4974-8584-9f09af7b3345", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.154.45.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50cff91e-7570-4488-bfd4-497f06c54848", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2023-1389. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.156.64.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d16efa6e-c6fc-4731-abf4-842ce61bcb4f", "relationship_type": "indicates", "source_ref": "indicator--50cff91e-7570-4488-bfd4-497f06c54848", "target_ref": "vulnerability--00b841b1-a0bc-4dec-bc95-bbd0cffd3797", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20633e28-298d-4e35-b8f4-0f25df9371c9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.160.226.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99bdb62a-c298-441d-8f62-f242820a59f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.216.59.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f3dd5bc-d7cf-4f26-b570-0db72c0ffdc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.216.66.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2646ccc-400e-46f4-9458-24eaa02fe9e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.217.248.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de188214-05d0-4800-9dae-fd3149916c6f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.157.163.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ada09ebe-1c90-49f1-a5fd-1e4c2d361a49", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.190.8.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b59a807-6b50-48e8-9530-e82e358cd82c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.245.1.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2e96ab3-2f11-421d-af98-42fa4cf6421a", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.245.1.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e843a7af-565b-4b67-935c-d36c709d312f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.78.104.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63798842-5192-4779-b887-2e9b3496c22e", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.93.23.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f9065a3-ea20-4cac-8f6d-6cca38c7be73", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.134.115.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04b9affa-6e15-4ccd-b7b0-0fce7d64463d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.134.115.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da892fc5-d20c-4c85-aff9-ebfbbc84930d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.85.33.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd453770-101e-4df0-841e-0df20a941c71", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.92.8.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d0d84f9-34d9-46a9-bb6b-f2f3fce0139e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.132.250.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ca1b21b-75f5-4b8c-bfdd-8d168f482eef", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.132.49.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d1c3ccf-741d-4d2d-8161-ed77169b1f8d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40cc4300-8699-458c-8d23-2ee4d8539a13", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8aa33d19-5113-4c21-9283-8f8252d08978", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90dea37e-0869-4e20-8450-c68ae0c57082", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc55e986-c247-44f6-877a-ef6f09791481", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.51.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce1c3ae1-ef98-4eed-aaec-70d0f34fae0c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.51.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--200664a7-fcd8-46ad-a4cf-6513fc5fc4da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.248.173.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f55aa858-bfb2-49cf-8729-7069947decf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.249.15.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a6af71a-bf83-4794-9ee0-9fea2c221e25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.250.11.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82bbb6c7-3b3b-4034-8969-de8f291b896c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.255.161.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc1ca520-37a9-4b44-8776-a46d4e785832", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.10.187.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02218e6c-d038-4e44-8d99-5bf6c1ec16e1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.156.126.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6881fce2-9072-4c33-b82f-fadb5fd3fdf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.159.119.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80f58702-b533-470d-9890-6441b85accb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.202.81.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fe2454a-ab65-4455-9859-498c67551a04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.207.34.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f49a7a7b-dfe9-402b-9723-7f8b4a44fd47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.207.35.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80342d7a-e4b2-442d-b9d4-020385e4fc06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.208.113.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d9e5727-9e4c-4730-bde0-abb51eb69b09", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.107.156.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c116cc8-00c5-49bd-a3c4-6fdc37d07e53", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.112.46.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2571cc02-f4e9-4459-9b38-28d0445a5ab8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.118.59.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--130b198d-a0b5-435e-aa83-6d167b0480e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.121.239.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--facbc870-7e4e-474b-8272-1d03b322613e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.124.177.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd7a4e76-f43c-4864-99be-a22c7fa3190e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.176.200.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d980985-76ed-4c6c-a11b-adbb7857bb9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.176.201.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee6c9e92-6c26-4bc1-adbb-247e03f878c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.89.169.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--117fbefd-95ed-486d-b742-c2824e6d75fc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.94.17.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0abebc9-0488-45e7-8647-6165296ddba2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.94.32.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3f58adc-251e-4342-bc7f-9f7b1f0af70f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.96.44.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7ee0f60-b1f7-433a-bd73-8a2d29b18b5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.109.142.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9b16964-e62a-452d-b338-73c5ff9a546b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.199.171.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53802c3e-101e-4687-b2cf-af7b0ae1fd7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.74.132.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cb104f6-d7b6-4ed3-bd67-6d82851d8093", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.75.143.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fc28c02-8e5f-44c7-9ba7-6110cfbdc5c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.239.11.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--975630ad-d01b-49b0-bbbc-4213d4f66cef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.239.4.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--348d619c-250c-46b9-b2d1-36f3afbb6089", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.91.97.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac298aea-8079-44ca-9d4e-ef4a74654e91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.92.27.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1472c138-a144-4430-970e-4074124adfe7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.92.27.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc3fe521-d89a-42f6-8f7d-391ec3f9a63b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.200.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--707a374e-d159-4f0c-9754-64deaf0675cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.23.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f692c24c-606f-45e6-8603-81cb0196c172", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.92.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ff1d863-d535-4a56-9c15-17e0d930b565", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.144.84.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3a4bf29-6ded-493b-a34b-820bc0c70920", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.199.96.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c9de37b-3c84-43f9-a451-f6f2f1889663", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.19.21.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efe7f90e-d69a-409d-b4f0-6b488f23ada6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.21.25.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30ddb8a6-e70d-49c6-a281-c0f8f0fd676d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.2.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2308e66a-da3e-4d10-b79e-49af90a457d2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.3.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10d3d40e-b70c-4129-87a0-5e449c9ae930", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.8.126.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8b02ae9-bee0-47d4-b158-44c2ffe33560", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.12.153.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b080ba3-9f6c-476f-883d-9531bfa9af17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.131.24.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93e19171-52bf-4e1e-b213-1ae8633d8d54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.139.79.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc44677c-4d8c-4e98-9968-c3978e36d80a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.142.170.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32bb3ecc-28e6-42e8-9a64-b681f24ffb07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.147.57.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8320d4cd-aa89-47ba-8393-00a5cb3822bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.15.146.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b442566f-3415-4c6d-9022-93c8097d4385", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.19.75.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--055e3fe6-1a5d-4c90-9383-8333ccd0c559", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.74.234.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f1824b2-239f-445f-8a3b-2c25b1922926", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.80.182.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6de369a-ab83-42de-82be-42121a74930a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.245.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f4b9cde-2cc7-4dc3-8dfc-5fffc0ff3bf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.85.2.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c24a4b1a-caa9-4399-a152-b1c7de0308ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.85.50.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea1f0a48-a5cd-43d5-a136-8f4a7ddc5cfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.88.219.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae3f3470-a79d-4040-b74c-61ccea910586", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.89.89.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98456ba3-a33b-4025-bd92-3d2e1f161ed0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.91.30.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b950e41-abd0-4a19-8aa2-616a73b65f62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--405632d0-79c7-48e6-98da-986b5a790dc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3c15d07-f7c0-4d27-8f31-1a488efe3e74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4c0dc2a-876b-4597-af4f-3c99eb9b021a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c91870-5c12-4478-8fa6-89298a4a0e62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f44c183a-b6e5-463e-bcbd-718698c6b30e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eabd2b20-ce91-4208-b000-05766dadb0a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20917329-81a8-41bc-88ff-49ba2adffce8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f9041d7-f188-4326-abc2-0dd4a1b06f3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--472ac426-3453-4753-be7d-a7ba7f5b7c7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54ece9fc-f0b8-45ea-8e2c-ac6faef22e05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.42.184.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9fc3857-f39a-479d-9efe-b807f86ece9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.42.184.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9043b4f3-7d35-4024-bc5b-67cc9f742a68", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.209.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc47179c-1077-4456-be00-3c4c76950545", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.209.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0419e40-8bff-4ba0-b4cc-8622f8af01b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.58.144.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8f04582-1d05-4524-b0ba-bff3f0ed7262", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '32.193.54.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd613314-a791-4508-985b-eb7587265606", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.101.54.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdf8132a-7eda-4d13-8e9f-a27dc0cdc46a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.116.147.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8382f03e-5263-4b7a-923a-5ed232d58ec3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.116.84.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dc3739b-a704-481a-9822-c0c7288ae609", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.118.241.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03d2958a-f3bf-4126-921f-84a7b3d63611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.129.139.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c191b4eb-2850-44c9-b070-ac8c9a549fcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.131.121.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14a90c7a-05b5-4e04-825d-fd1acc1074af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.131.78.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3c2575b-c2e0-4cd4-9c1e-0d92457718ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.44.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e170034c-8685-4b59-8ff8-48a609aa451e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.56.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fb71b31-6fb0-42a6-979f-ef7157b05991", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.138.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61d2601c-be8e-4277-9195-3dbcbc21e270", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.179.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf3277cc-ba08-4533-a9a9-aebbb2f4bc1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.253.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41f7ed58-fb8c-4eba-8c89-00f54b54a40e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.255.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62c0778b-7a2f-4844-8251-865f8a814cd5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.162.114.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e406797-858b-4836-9463-2c624c77a3fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.174.122.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--951a8e1b-a02e-402c-91fd-0b9a9fe5a61d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.181.244.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ed945f5-dace-486f-8c50-48ea6739e4d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.193.119.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ed84438-de40-49db-9bfa-d09d9d704b40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.197.70.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e1fef7a-e4ad-4c74-ae0d-7d38bad7e15b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.201.69.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a15a0cd-ffe1-4d00-8833-3ed4e85bc938", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.224.168.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ebaf1df-dd76-4c87-973f-471632b782e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.228.104.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b447b46a-14db-4655-b380-5d631f6a272b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.230.205.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2b775d8-66ba-465f-ae46-52d6107c2764", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.230.221.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad5bcd46-5bba-4efd-8208-6e51c33f8c21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.238.121.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29f556c-445b-4084-9d5c-91a3e378b20e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.32.169.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e03d015-ccb1-4f35-88ad-d90f02b7de20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.172.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37abd40b-46c7-495d-afb9-09073714abd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.151.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8642c99e-8c14-44be-8173-c0f8ceaa91fb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.48.163.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--473aedbe-2ce3-41fb-a254-dec63cf2ce1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.158.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67affc9a-548b-4162-a573-52978a813b3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.221.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52839a18-7a89-4f16-bc5e-31f2353fa627", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.39.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ba44474-1326-4775-b273-41b3f3eab74a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.70.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e67de5c8-53b7-4b03-8dc4-33dc23c2acaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.92.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ca3319b-61c2-4d66-b361-79157ee260f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.64.177.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4bfa344-bc09-42a5-a340-cf7d022ccfe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.65.87.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fc403a6-1c1c-4e04-a2bb-c544ff444b50", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.71.30.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c094789-5566-4107-a007-dcd5362ffe71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.117.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf6b18cc-5570-4272-bfbf-122a4ba208ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.182.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ac19de4-71d0-4577-85f8-cfd484dc366c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.50.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a67828b3-27b7-48d0-ab79-a25e482c8833", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.47.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b57064b5-6d2c-41c3-ad81-e7a83ae25d39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.93.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--973574c0-6dec-4480-8177-632ddd2ad2d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.121.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee2bfcc1-bc71-4f92-857a-749c93a267f7", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.150.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96a0b81b-86fa-4592-aa71-bb1329df4f8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.158.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e54121dc-edf3-4eed-9274-4f7745578433", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.80.193.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e564d49f-6374-4f28-9fef-01e0156da5be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.87.71.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b81d71f-8cad-4f4e-8edb-2956c199ca32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.90.182.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1751fa4-32ff-4aa3-a862-a64d54488b97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.26.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e969c497-2112-4a2b-97d3-2207337eae03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.169.206.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57484cc6-ac18-46c6-8fb6-eb1d29d2a6da", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.187.79.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--041f19ec-ee43-4551-b7be-0a5ec4a7b22e", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.84.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--380d5bdc-c701-4aef-a35d-54fe1bfa1a00", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.89.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ac09d7d-d847-4578-844d-1149f2d3e7ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.200.195.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5df843b3-e538-492d-b780-ebcd27a67b0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7df7e38f-5155-4fd9-b843-ed80e334c243", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3543dcc-aca6-4a86-99d9-3cd303f4dd45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0215662e-3dc0-40e7-a2cf-f799881392dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f0fcb91-1563-4094-90fd-33fbfe1373e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--351d4776-f103-4253-b72f-46001f872975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea84e5b2-b138-487b-b11b-927021499daf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ee69cd5-b989-4b15-8d6b-ae66fc80d6b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8edf086-e96c-41ff-935d-d7ddd5c2e0fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28bdc1c4-53c8-470d-bfbc-9b2ef8750585", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7784207-bcd0-4938-b525-a38a9cebfc62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bf79d72-8296-4660-9ba3-2944764ecd9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b831e731-f279-4622-a2b6-32b03e831020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be316160-86c8-487b-879d-2bbfd6f99a5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e1c41de-6340-44d5-82c2-08e5f6b07faf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90fe4e5e-00f6-48aa-8b21-ef20053726e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e97172a-e6c2-4a52-a700-e1fd296c60bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffd232f4-c0a9-4adc-9b31-c92e91339d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d28642cb-66bc-4c83-a722-1296a6d65360", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a5b232b-a19b-498d-9c16-f3d9acbe2499", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--464e5033-790d-47a8-b83f-91e07a742fe0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6220e54-4770-4337-8457-6556ed89f28f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da475c21-dd7a-4950-851a-6865534fb840", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69a3c9db-3cf5-4dc3-9e68-61feac7a8483", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1435fbd8-7a5f-47fe-a1d7-a787abf1075a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4f85189-9c65-4a31-92c8-21a9cb6ec09a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c16ce4-8383-4a75-a4ee-1b238ba6da60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0130bcd9-d175-4ff9-9877-ad87115d9fca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae16b247-0882-4d8a-aadd-38a7fdeb5133", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7ea9dc7-e0f1-44b3-b615-68f0a0bf8cb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8aea9dfa-4e8e-4e3b-9426-2503e5ef9cd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef36b6fc-73b3-4ecf-8c08-4fabc45b41cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76dac8e1-e624-4960-bb75-c4f20281adbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b9d1ca1-5ac8-4589-91c2-2f72e734f17e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a090c497-07cf-428d-a40e-a39c6a378247", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83b6232f-b434-40b2-8db5-227f521878c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a3a6cc2-b657-4ab8-8951-239e71cf2c31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a465617-6a1b-4aa8-98a5-32a343f5364c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4576494b-183d-46f1-ac1a-527a88a29c9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee16f99c-e195-4617-a5b0-41e7082a083d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d89935d-16c8-413d-8680-095d419cb2ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a13b3b9f-715a-4701-aa56-af6dba0791b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6293b24-0d3a-4c1a-9951-8962f91c1b83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33af8ba0-da90-492a-9fda-9fcb73f238f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55ee782c-d790-4ad9-b2ac-6872f8c937d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76ae47fc-1843-4c93-92a7-7f41a72fef7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0019466f-9d9c-40d1-94f0-ce855d52638e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0546b7d4-1718-47f6-8f8b-a05fa289a954", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01fbcf2f-05e0-4a6a-a5f6-68d33d19d829", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df201f49-1256-40d5-9f7a-00f971cb8761", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71e00cb7-d0e4-4522-93f1-cee07b4c1445", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0fb8151-038c-41ab-8304-94732d135fc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c10f984-2cf9-4fd5-b5fb-0ccc0101e97e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3f6a01a-27af-41d9-923a-9349b875cc35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a8aa5f-95b5-4a57-a21a-e3a0d6a7aa1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2019259-4b80-40ab-8cf5-7432927d67ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6f032d8-047d-4bc4-b7ea-d69ec28d9a71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5623096d-df9b-4694-8885-a5b6b926c6a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b495ccb-6a63-4777-b8c9-8a7c663b76a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43de214d-ffb1-4d7d-8911-cf8b75904f9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb5c8ef4-7814-4273-9c79-d9646aeb599c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66d84b55-96f1-4702-a775-900cea086aa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abc16421-149b-4ba9-922e-84dc99bee41a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d56c820-ce14-4807-8a2f-a975c210950a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38038a61-ce1f-443f-af1a-9527924d69ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebb3c657-79ea-45cf-832c-2707fc7f86a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d36e62d0-8c6c-4217-be0a-2afc5fa5903e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc4f3fc1-f56c-405b-9e19-30151de30197", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf755883-9547-44b5-9cdf-862fadbb435b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d301f14-a432-41bf-8290-2a07047928ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7df5457-bbb8-4f2e-967b-0e545b9c9a34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd3c5d69-9eb8-4e4f-80dc-9e7e9b50a7c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7af16465-3e7e-47d7-8d49-ba6664ae5151", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5367888b-21cc-4654-932c-d2589a4469e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92707fc2-887e-4e41-86e4-90aa9c10dd5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b77f1e6a-5c86-4522-b42e-2f8d472e5711", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88feafa1-7860-41b8-a148-f0434bbba335", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--680a48f4-e5ec-4bee-a6e6-ebc785de34a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a512563b-9850-4d3a-b24d-ebfaf6964814", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7faf03d9-e5cc-4870-915e-a091c6dfcf17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf51c73d-4f74-44d1-b996-a85d475d8709", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0753fd38-884a-4d93-b7af-d233fdc3d482", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcc576b3-9b63-4455-b717-25c5d9bb88bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f76f05e-2626-44cf-8c21-06b3886a47a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d041ae93-8294-4066-a40c-c2daac5f2c03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff0227fd-5f8c-496c-8688-425b3db3f15b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a7c6f5c-8f6d-4fce-9579-0356cd63a6a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e02c026-dfa0-4355-b108-1b1ab457c75a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b22afc7d-05ba-41d6-955a-62a0e4e783ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--055cb28d-b071-4549-8343-e5987d8a4e2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d648cf33-4ab0-4397-aa50-50ab80f1d9ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--753b7fad-da7b-4467-95ed-894415f881e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e976f6bc-35ee-451f-83bd-7fdc18dce660", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfb84536-c848-4ecb-99e2-dfc0b0494156", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb527c57-1a45-4881-b4cf-9c7222266563", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef0aa436-e30e-4c7d-9b72-597aff51ba95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--847e05ee-07f1-4c8a-8108-4619764c9fdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fe4049c-647c-4d43-a41b-ff82b3aa6b0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f704e87-13ec-476e-b676-2e6e924aa7b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e43bb4ff-7659-476f-b5e9-8ad956d87d29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10575f25-dc51-4c2f-a304-3b3a04ecbf04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85711dc7-46a4-4fbb-a1de-34d399ba8fb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c13e09-ee54-4db7-aa0f-fc69e067d45a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37d1a7c3-4a82-45e6-876f-d051fc412ce5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3d4d44b-ac4c-48b7-89fb-74589980e8b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14d4f00c-87f2-4526-9458-7751a1c5774a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cd963f9-6807-4f11-8c0d-6ff3d8937cd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe0eda18-7fa4-4f71-b08c-1ba1a45904f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b567a608-4a24-49f3-b829-3228f5f3bf87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--228caded-7e9e-4975-85e4-6682bf8e23e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab32c5f-b5b2-4365-9212-c2b9727f85dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--824c352d-ceee-40d7-8b18-dcc17ce43213", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c238dc56-ef63-4337-bf83-45fdaf517473", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b31c533e-0037-4999-be01-0deb37c8e60e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37217d0f-0afb-4746-9b10-f216035e2589", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--110fa753-df09-4675-be1c-1f65f576f115", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a7c2207-f511-4e67-b98b-d6260281b41f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69e3ed1e-b68e-4d2f-b60c-c929e0bb3ad3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dabe32a8-238f-49b0-969b-54816d24c2c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2253fe5-f25f-41ad-b314-d60fd2207b81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43dfd411-84ba-4600-85aa-2e29b7ba5aa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--377871d7-0030-474d-891c-beb678543893", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc319de2-c77d-4cf8-b02d-79cf2a35dae7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3326a003-f948-4069-bfe9-95820462794a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e384208-8336-447f-8bb7-5a54c81f604a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bdfc120-84e1-48c9-8da3-00aa50b3692d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8d5612e-f3bd-4862-937f-bb4bda51c780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a8e79f3-37e9-4a3a-b766-49cdc2b40fe6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--906f8eca-0004-4d0e-a9d6-408f72ef89ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--589b9ead-551a-4fb6-880d-2aecb84646ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13b09886-2e45-4a10-a200-9e2e60125e55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7385e8b-414e-4a67-b219-8f45a3cf7d54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9193dd68-6f28-4cd9-88fb-96bb5907d0b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3af5cce-3315-45e7-8b02-66d5fb5c5f44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8dd6688-9ac1-4acb-84a1-7f07150e6748", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ac5c285-3059-409b-ac9d-316359c48ad3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dd9da01-7757-424b-8bfd-58fcbd0d7450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c598a337-d5ff-4ed4-81ee-a1a399ae06b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e0eca28-ff41-4727-9213-bb01a7c950ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63c9fd99-3a52-43bc-afa8-471e6af1ee3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5febbb1c-735d-4427-b4fa-f3d52a33ffb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92e0380f-f4d6-4b8f-b1f7-48e997d83278", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b3c5031-4ee0-4cfb-81cd-6115ff099629", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4f66fe8-7ed9-4581-a70a-319c6a373fb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--469b6110-677b-4517-9e02-a6e00029127a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--650138d1-1dd8-4b0d-9347-f1a166d12e4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bd16678-be5d-44bd-8de4-0f07240dbacc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a3ba5b7-67cf-4503-b2fe-69610fc1bbce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08752711-67f5-47a6-9932-43ddc6d21d02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b23ce3f5-339e-4771-a9b9-e0d558f1a2c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5e754f5-a9b8-4ab8-b80d-de77f0b1be05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88734961-e7e3-49e4-b5ae-837b3c965bed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e86d731-e822-4851-8237-848cf8cd6cd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cebf8bb-692a-4b15-92d0-6acc862519bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ecf6178-615a-410d-aae5-e6cefe115755", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3903bcfc-4c5f-4857-be35-2ff5c0c0d52a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffb963eb-e839-40e9-ba56-d3ac8a15b79e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e89b66c-1aea-4dc5-96e2-bd2ee7bc03e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e835bd90-9f37-4e2e-a170-beeb9b62df8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38cda3b2-ad47-4136-8127-338a98685537", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--923b5bfe-1719-49a1-b256-76a4afe94fd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11f04b1c-a575-4398-8614-c9d9a1cab84e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3ed90af-c753-40d9-bbc7-a0fd3da22da2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47666c6b-fafd-4c71-bcef-85e36bc08751", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46b0a3dd-bea2-4d0a-aaaa-e34da32af0fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2432bf21-2e94-4fd9-bd8f-3f800d2d8bb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23af2e08-fbee-4c14-9a45-d8b0c03022a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb8b533d-4c5e-44b2-a6fd-fac32d475b30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69cebfd7-445e-4447-b971-e0e6b62f59f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--108a3103-ddf7-4231-b447-db908ad58b86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc932f1b-04d2-409b-8e0b-0d9d7472c233", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b49df34d-a6f9-4304-9641-879223739417", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56b51a08-2b40-4791-afac-bbc457e84a1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25f36c58-e33b-4fbc-8630-2c51bcd9693b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89afe07e-2431-4bcc-844c-3401119ec562", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--939cd52c-a264-41c1-ab4b-406e28bc35be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cc88550-081d-403d-8a58-2f5deadeb5cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95be7baa-981b-4f84-998f-cf42430cfc9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b0bcf94-3a24-4745-997c-b71ac3040572", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f57f90b-94e1-4c47-8d9f-1105768d72eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a9bd56c-d9a2-46af-8f49-02133ed6e843", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--579d6e88-a17c-4356-8b44-910557308bae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b09638b1-c0f5-4d76-b12a-115c08daa548", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccf72740-f48c-4542-ae1f-db7b8453fb53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8263098f-69c2-45e4-8e89-faf2d0b8af21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91dbeea3-fa7d-47d9-aedb-f3b1f36abfa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eefcac2-4dcb-4fe7-8868-5d3004795afd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--218910ed-6c5e-4337-b77e-679002e3d6be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dc85db4-593c-4fe6-bf4a-ce561c4fd135", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1481f977-603c-4818-bdbe-3611cddfdc15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7462af77-3131-4b2b-a685-4a49729f18f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e4bdfc2-6558-4cb6-945a-50091786a318", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--385c72fd-2b32-45bb-a69d-a2ef2cf9444e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7fee3df-d9fd-40bb-850d-650c5044718e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15118ed6-f7a2-4fcc-96ae-0979af34c0d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e06890b-fee5-42bd-a4ae-63b281ebb264", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d10cc391-520b-4438-b3b9-f3bbf30ee300", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e147e4e0-4eae-4209-9df8-a7ee2712d4ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe5f7947-efd3-46ce-b6be-ae62b2b27fc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--233862ab-ab5b-4daa-ab0b-2418c97a0014", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df469365-827e-45a7-a1b2-92f63c0c4a26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38bb9497-cdd3-439b-a550-c99b6278f9ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81d3bb2f-22e4-434f-a6ba-6c664dfe25e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fc1ef43-099f-4ad0-820c-3c0bf408f6c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af16ba2e-21e0-45a7-8db5-ca20ae82ced1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d210cc2-9fdd-43d5-8a3c-81ecb4cd79f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2213fade-d7c8-4b86-bcb7-6f770b0f0900", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3475efbe-3764-422d-b635-74b684c2433e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f966191-da34-4271-8fd4-85cf8b8463c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef2394e9-1d0a-4b39-93ed-8ce52cb00737", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fa4df8c-1e2b-464c-8996-7a23827c187a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a8398fd-756b-4727-bfd9-c24556cb69c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd36f114-54dd-46d2-bf3d-d6a93484e4cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1267cb1c-c1be-4073-8c24-e39271ecc715", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39ec7d2c-6108-4d29-a3ce-e129925bb396", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a2bfe11-94ba-4aed-ba6b-b0f0fdaf3b96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e011c0d8-c255-497f-9de9-0a57a5df04b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d708904b-0094-4e65-a557-b940e0f4a929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c727105e-9fb4-407c-ad62-0140239e1be4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62e32bfe-4c95-462d-b22f-43aadf1a7f12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b525e837-d53a-41ba-ae5f-6dcffcfb3d83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--600ac1ba-d8e1-4104-9d64-178005b0592e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4324a72e-4cbe-4964-bd25-86e6597aefdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc8a1c7b-f346-4b95-8b76-46429ff7d81e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c63e2c9-4035-4686-9c08-113e05fdd0a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b95c8c4-a46f-43a0-b283-e5377ecea3b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc70d760-7ad0-472d-a3d1-dee8827f5109", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06da88db-ff14-41c8-a02b-e16d291ca4b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--325bc272-7cb4-4b96-b442-3608135897e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be0c48f9-29d9-4200-be58-358ea49009d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6bfd32a-59a3-45ba-85db-a5843efb8a2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3a73d20-373c-4337-aa7f-5c0cbb228ee0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75acf9d9-0d2c-434e-a427-0e8687edd55f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61ab7082-0578-4910-b4e6-d84c8d6667ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--422b2394-2aef-4390-8611-fd2d610b4f3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42952854-e946-4c04-b62f-93cff94afcfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c40e319-0ef5-4c21-bad4-2ba99dedd6df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f03bd7e-0ecc-49f1-b7b5-582fbbace294", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64fb355f-acf4-4375-a9b3-e8aaf4376476", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.15.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0415a227-e9f6-43e7-a65d-998553e49d3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.2.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cf2de7d-934e-46c5-97fc-04a8e5e913bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.55.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a10e406-1ebc-4067-94c6-cf5191babdf5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.210.61.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65b03642-f90d-4052-b640-174982463c26", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.140.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e460491-faee-4b84-8f29-ede51a616800", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.189.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5456c0f-acff-4505-908e-b43440929e16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.195.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03e357d8-3f24-4525-b96a-6be940dbfea6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.234.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4103719e-cb9e-4c62-b196-fa92677d06ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.222.46.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22d7be72-ba97-4b48-94a6-de600ef9dc96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.228.242.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe5657bf-d641-418f-bf5b-71d381b5337a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.15.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61ea615b-f928-41bd-ad23-b81fcd2f5f9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.69.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50a140dc-205b-4374-9439-f353e8f1c574", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.235.71.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ddf2e1c-521d-4b6f-9089-27a222059e30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.240.118.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ec3a398-3c7d-480d-8266-c4ee7e4f4fd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.240.174.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d110060c-fc08-4ee1-a1df-ccec62dfd52f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.241.230.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9f9235d-2ef2-4093-b0fe-e2872207fd07", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.252.219.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fe3beb1-e259-437f-8a25-ace764be999b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.254.72.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf2147e4-26ed-42ff-bcd0-a10524268b1b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.93.212.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--572ff091-e496-4566-acba-5e88f2f3a182", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.21.126.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4575cce6-c6e4-45f4-94fb-0294c3ee3fc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b78d874-6c04-4ecc-a48c-db54f0e66f43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b296870f-4d89-4859-88d8-84fa085e3063", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd21821d-bec4-44f2-8693-6b94c4ebbe21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99c540cb-ac78-4afe-bd30-97710d1c63d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3955cfae-349e-44f8-aa8c-29d9f966fbe2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbe5e2fb-6538-4de1-9e93-2d827c299d7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--604bda63-22cd-4811-b809-4f9f688d5d13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc82b35d-5e33-46ee-86a7-12fd2ef9f5d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb309618-2f53-4c9e-a7cb-b11b113cefe0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae14b51a-eeef-45c9-848c-25abde6cd349", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34b59046-e78b-4aff-8050-c6a13444825f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--196004f1-c3f5-4a78-bfbe-e2c14aa3f80c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--257cee98-9e55-49bf-8f70-6397b42eb164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7905cb33-ccaa-4656-929e-4f80ff234e4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--382a50c2-8acc-4075-8d67-0a9a6d2b10ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9434b938-8099-4211-b52b-e28e09b4f80a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b0bb01-a030-469a-aaaa-ce24e4606f03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9e79dee-0ce2-4467-832c-425e088f2cb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c12093d-7aca-4067-b90f-bb5fd2ba9ec7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--149c15f3-1178-42ec-86bc-c47581363370", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ecf34c3-5d44-4cb1-ae24-9cce52b5f588", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--512937fd-e0ad-441d-9753-31e14f9c1df3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45837ee4-37bd-4693-a120-31f933ff8a97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ac6b78-a2b9-406b-baae-83e1007a19bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ef04804-8bc4-4ae5-93a5-17eb30f722ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49ba0c89-2a7f-447a-a4b9-8bb80059a1bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14e444d3-d822-4cbb-87e6-39907acd02ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea97bf54-2024-4707-9998-04f855838697", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cff8515-428f-412a-9ad2-4929f4eb9e26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.97.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9cb8e6c-037a-458a-8b1c-b8690101e47a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.26.82.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ba3c228-a2f4-47f2-8a8a-481bf183c8b0", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.68.52.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6faf630f-9815-4cf9-987a-c2d8d047cc8d", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.70.230.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1db15b9b-a656-4b7d-9bb2-a08307a1e5aa", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.78.107.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--482c677d-de83-4d51-89b1-ac8139a4a0a4", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.89.38.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--821cff8b-14ab-4017-8181-e25eef268bcd", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.99.140.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a768d5d-99e4-4ace-86c8-6f1f0c6c22b2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.143.61.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e298fbc-35b3-453f-9bc8-6d2a2e0f4cd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.211.8.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f58502c8-04a8-43b6-86df-8ceee31d929e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.236.163.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49750bc9-5a86-4e1e-892a-1fdfc87868b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.77.150.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0f5a4bb-9301-499d-8cf7-ed40b537ff17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.146.28.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e19a214-47d6-477e-90ef-850b09439ab9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.210.202.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f954b62-1bb5-4ae8-b194-38cb178d6702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.210.202.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91b7e5c1-de5a-47f2-a614-fac4f755cd66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.210.202.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68d4c0b4-c8a9-4eb2-be54-ba6ec75ebd5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.210.202.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ca2afef-87f4-4ea4-b769-61e9e7192742", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.246.226.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a7b16ac-6b0a-4988-a9a4-af2022f918ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.96.178.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d09fca7b-0323-49b8-8328-30a62e7cac2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.105.202.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a44a55b-40d3-47b4-a9e8-0539efb7dcb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.130.240.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0baa4ead-ba7f-4527-998c-a582a73507fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.97.54.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a1ba108-1a50-42ec-926b-9ca0d7a125e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.150.190.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f11fa1cc-53b4-4a3c-89e1-88e3731ca08f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.204.193.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--993a3099-570b-4d22-8cb8-4f98ace3c665", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.227.178.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7973f2d5-0b81-459e-98da-89dd4240db96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.32.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77484691-0c93-496b-a1e8-2c0010f271b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.33.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ee27a38-5ddd-4c36-9bc0-ef7f97649fc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.168.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6122950-0b02-4040-8541-7fce9c989af9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.172.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35c426fa-6477-43c0-9afb-246b63d73429", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95ebc9fa-7fce-437a-8f4f-d8bf48ea1d42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14194b16-6367-42b8-ad96-8e530d9b26e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b87c037b-f256-4ab4-a4a7-3ea1fa3589a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eafea9d4-c691-4312-bf41-e605255c5f5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13c1a2f1-7cea-4cb4-82d2-f942453a31d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--112f3e71-2cc5-488a-a365-56adcb43b159", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.186.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a2ff9a8-e22b-49d7-bc4c-1b24a1e80a83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.65.222.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ff43c14-60f3-4369-935f-645618ac1d92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.67.177.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ede020ac-0e45-48ff-b81c-3e07b7c38b02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.116.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb653bc2-e84e-4a16-9031-0c1a4b843731", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.124.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ac36a11-453b-4e83-84e9-32123c5c8838", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.124.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66fe3682-e8b3-41cd-a148-1d26d65c1a17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.0']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eab45e0-57f9-4aef-a9ef-8237e384b82c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3f06152-d8e6-400a-8956-0fb4dcc2be28", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7337855-1d6b-445f-a569-c4dd786229ad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a236d970-2003-4026-8291-5f46243a24be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--705e7b7c-b0ea-4d99-b429-7cb4ce448a65", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--371f73b3-a95c-4195-8c49-7cf592be213e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efe3ac4f-4a59-4244-8755-c02e117a1798", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d25a27a-945e-466d-b226-18cecfb9424c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4812ff73-81c0-4690-b420-fd903fed6499", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--867d8383-41e5-4c70-8fb8-b0f8aab1c655", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f1e49b8-0553-4e08-b90e-7865ec30a6ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e31b52a-9dca-4bf3-955c-c362d8745a42", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71cbb122-f3f8-4982-910f-eaaf0bda4c23", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--598d355e-3ca1-4732-a62e-6778cf04079d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1246a9d-2263-407e-a78b-7b0c908168e8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a90559ac-9c75-40d6-b8d1-50702d0ce5b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35044278-78e8-4f61-8776-e98868d30203", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1b42ea3-04b7-470e-ac1f-9dada6d344bf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9283af7-10a5-4862-a872-7b2936032aec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--246c8017-ba1c-4bf3-abf6-65d794f0e32d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a071d886-a6d6-4a6e-9dd7-098f15614ff6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abff7c83-39e2-4338-9725-3ed2cd542a28", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ad4071a-1d38-402b-942b-1f7a9f990625", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8998ca4b-67e9-498f-a8ca-1bc7e02412bc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da15afd1-5805-4eae-a9e8-b09101e8fb98", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70a756dd-cbca-4a40-868c-db3e374f359e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47f4474a-8620-48e5-8cb4-3e0d7c18f00e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d6cbfe3-66db-4bfb-9ba1-2270f6b6e2e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfd8cdbe-b7b2-47e2-8978-c419b3a28b3d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d6189d5-a587-4530-b99d-a7b88a4c860a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--945eb530-cba4-48a1-9ea8-6515885395c3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db7aa9d-58cb-4bb3-8150-cabd2841164a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d9f7797-e19f-4ab7-a603-18bb7e8c685a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41345679-3edf-4acd-9f08-6de128c0319b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04870fca-2117-4701-bd1d-690ada2c323b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9e2b26c-4cf1-4b2f-9217-c7c94bb78e54", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e1b4738-a7c2-49e4-8dab-9230e3357123", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0535945c-388a-4dce-a4d2-a13c0d5ca672", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd47da18-d1a4-4d20-b840-a8e00401c436", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.63']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3100b787-b6e0-496d-8728-f20528ea8687", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bdee152-b05e-4c15-a87a-ea7d83802843", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41d361b8-46de-4214-9fac-9ed7da0a0fcd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdf13cab-938a-409b-8fea-1ee5002206d6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.111.178.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac888e55-62f6-4595-a0d2-e3718885e8fd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.191.229.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a76f4289-7e79-4f42-849f-bb32a6ce9dfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.248.233.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a66c3285-accb-4d65-8295-d115cf47a3cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.57.128.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e31ed053-2a06-440b-a927-c336c1ed64af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.83.147.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f673968-8530-4b74-92e8-c484129265e3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.60.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38716a06-b404-4355-9298-483cf29271f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.106.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24f9f3ec-d619-4317-a7a5-dbf6965d917a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.3.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b348f20-7615-464e-a031-a73f69dccfd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.39.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b3881e5-e27a-4afc-908f-e047be67443b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.60.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81bdd17a-66d3-45db-b4a6-48d46dfe8094", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.131.60.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00dc5638-2a67-445b-bd20-360ae3f097a7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.132.227.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82cda69e-c229-46c4-b3da-4cfcd019fa32", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.148.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f087f96-993c-49ad-b51e-9c80a9a6c103", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.220.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90c7c966-6f9a-46fa-aceb-98b628faccc4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.32.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fa570cb-66f5-4a3e-9563-c23f8c021e2c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.127.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22996d9c-93e4-43eb-886b-20f9ee79de70", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.136.110.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f5c2b6c-6bb0-4b98-abdc-eafe21c094de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.138.68.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a169ded-110b-4829-88a4-eb1532277d78", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.139.23.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--410a1eee-75bd-483b-bcc4-5d2e26345bc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.10.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6bd8640-847a-4096-a31a-26ca04076cf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.122.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3be9b03-ff60-446b-affb-dbc75838bf11", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.123.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68d5f861-cc56-41b1-b2e4-f5302966a224", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.134.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8006b556-22cc-457c-ac1d-ae2136543f9f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.162.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c07ea66f-0471-43a3-aaea-edb445bf5b4d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.201.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77d2d4f2-9619-4bba-8b75-fb486a305529", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.212.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b390b83-8640-423f-bd5b-501ab99f0ad3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.188.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d87aba30-f839-4ac8-bc7b-286f816ee605", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.53.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12549516-955d-4049-a5e3-eb213568f3aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.138.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34067038-85b5-4290-bdea-50b30bd55d19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.152.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--254f8ad5-3c01-4adf-9c03-c605e6ddfdfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.160.253.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d9612d0-f37d-42de-b7b7-8494ea3aa4d6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.162.112.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5277a32d-f5d6-423a-975a-c9913ced195d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.104.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--103ba07c-60df-4e5c-9d46-83b808a15f49", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.197.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c2550af-dc97-4158-af0c-b0baf193fd27", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.126.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40c5553e-1eab-4b6c-b834-6c05070442ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.197.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82b05e8f-dcae-4d08-bcc1-7d77bf4971f6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.3.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06d30892-d6f4-40a1-adab-549bb30157a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.128.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c547f14-f2b0-4e19-9bc5-2d4a0b77f277", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.226.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2ee5db7-5f14-43b5-8049-a13cac703477", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.250.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90a1d79b-b32d-4516-9398-c9b70b80beaf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.185.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11fd5bcf-8055-460a-96a8-96d707f87722", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.215.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e65c1a50-4860-4de2-8a4f-6f22968a27ca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--171050c3-a60b-41e8-bce2-cb31cea533b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.187.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1306e4da-b091-4567-93bd-a8eda732e21f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.226.36.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--706d8c45-74c3-4321-8bcb-d2ce0b1e50b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.226.40.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--426e9a63-f154-47fd-bb01-dc8a0664db12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb309564-dbb0-4d52-89ab-4403339b66a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7a318d2-dcc3-4bad-b8b7-f6910efb9611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f205b68d-9a22-4d9d-9202-59f36d00374d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f07560c8-6ef0-4d42-aa3d-f80df9f4b3a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfb6ba7f-9128-4d72-8590-7628ea80d307", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fae791c-2293-43f6-9516-e1363948d8ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e9ea913-f74d-4b63-9948-449135f61e48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aec13a27-fccf-462a-a44c-97dcc3c83ea7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9378ce4b-e99c-4407-ad5f-3c34669b8e33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b697be85-635b-4d1f-8b45-7f5f7bea0439", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2718003-60c6-4179-b91d-bd806dfb2fa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a23df92-64f9-498f-8cd7-c0897502376a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--875488cf-b131-463a-9b3c-203f0250739d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf4a300d-22c0-4133-8b57-1463a9d52310", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5f8fdac-3ad3-4791-ba2d-a6ffaec6f198", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67787911-a9e3-4fc1-b252-7084a0c4bc52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3314f63f-2734-4468-b98d-d5eacf91da28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3246f1b7-de59-47d3-a176-bef73f667ddb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ba152b2-d761-4d50-a90e-51b794a6f32b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3507b3f6-9024-4818-b9fd-cebd84c42120", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16031125-ad4e-44e1-b233-868781948a9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e0cdc5c-fd00-4ad5-bbb0-e0fb3d91e183", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1680335f-6fb4-47b0-8c30-e622d937c68e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c0040b1-2dde-4cc7-ac5c-e5ad128c2a9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9938925-b28c-46b9-a520-cd4a8a8263ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6435035-5e27-466e-bd89-8e8edee48686", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac5a7a29-e2d4-4b27-b299-c5466c14d5e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--726fbcd0-a72d-4974-98cf-03f470452975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d03be4b-9279-4ba6-a4ea-788f412ae512", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44013d5d-9f0f-4421-a341-63b0f9584968", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46614ef0-08dc-4e2d-91a0-1536a48c7d33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8838922c-92e1-4536-83b1-4bc166198a34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72263ea9-60d4-4931-a4d4-55866b6bdb6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e31b5ab0-65bc-41f4-816b-80a15ee27310", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cdf3f88-1757-48de-9c61-2dd15e8fe65c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea002e96-3abf-4cf1-8e23-dfd7282fe629", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e4896ea-23f6-4292-b573-4559cb3a99ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9e8ed6c-c827-48f4-8d3c-620a6dbfbc1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ba8266d-64d1-48bb-8d9c-7231ea371c66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efc702a3-843d-468f-8bf7-1c7fadec7b22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b997b1a-3332-481a-ac8b-627db735b731", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89b9f2f6-dfdc-48f3-8575-e528bb159e7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12de30d3-0744-4a9c-8486-d93dfd77d466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d5da108-6991-443b-99b8-4ec43ed76615", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3981bc3b-130f-459e-81f1-4eff74edcb32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbcc58cf-fe36-471f-bdb5-89c2b4560505", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a09a38c7-d02c-4039-b826-91e5189ad128", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--711dbe0f-e51c-485a-a484-de82c99b581a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa6414ca-6172-4570-9b69-78815e2e966d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--603525fa-d128-4f20-a653-b8f06655cea5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3adccce1-facc-430f-ab2a-6972182948db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f957790a-0348-45e2-8e18-cfeb95f70e2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--333764fa-37e1-4dee-88da-ba5567c37946", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1bd3b91-f36d-4ba9-a70c-2d50f9df5512", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9519e8d2-7e53-4d2e-b8fc-a1c094528426", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--378a3ac2-ad42-4fd4-b145-cb06b1637885", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af9ab249-0c0a-42c5-8fd0-842c0e3434b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31141320-fbdc-49f9-b35b-4a967dc4ffb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89c4ffc7-22a8-4f2b-9ccd-ec7d37760a5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e1981f2-3476-4249-b9da-f75a3c472a44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c433a025-3a43-4cc3-951b-813a2c0f5334", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--184315e9-8149-47b4-8fc8-b462d43542f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a18ed007-3440-418f-b8b9-a46dbbb787b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f441721-dfcc-4e73-96fc-9b72fcf5422a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51dfcb08-0c36-41cc-8ff4-fb720c0a698e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c766a91-0695-4b2a-a390-c890741287ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a2ca3d7-c9d5-4f86-a44e-d13411b32466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c327c2b2-d734-4e8f-986f-9e0ccaabd2ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2469f16-d5ee-4636-a1d5-c5de15077c0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95f92fa0-af6f-439b-95c6-f09171a1741d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ebbe5d8-173c-42d0-8dcf-a1f979129195", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--758b511e-2750-4c0f-af5f-5aa973f345a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20ee6028-caee-4e57-ae1f-8e2c9904f9a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85ffb749-f319-4e1d-8350-b8ff5bd90c39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--239e9645-bc7b-4ea2-8146-000933cfd50b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43d28a1f-3dae-4438-a1dd-f5ca805ddef9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ec860ee-546c-427f-857c-3d370166c561", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf9753f0-6206-42e0-ad15-9930d0840a7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3a944d1-fb37-426b-8408-5de32f1f2780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2443762f-b4e4-4720-bd5c-a614c637d4c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e731dd54-a915-465e-aa12-726c1c5bee91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1ac26f5-70d8-4916-8123-7793d8471245", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e79b75eb-84df-42d6-8896-38ddd67f003c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8554c4a-d2f4-45de-a1bd-eca90d7d8193", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3328d2df-bec8-4d0e-b614-d8fbe6142ebb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec29d8f3-7fb9-4172-bb7c-f041b1e9f55b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5407db4-bc98-4c32-b2ad-84b747ab7549", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b712bdc-2a05-497f-a309-6f0e3487b16f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d18aed4-cf49-40eb-964e-b3d2a4251870", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17f06132-afbf-4cf9-98fb-724258095704", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.254.206.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d63ef97-2c2f-4a53-b3de-f8c61f73fd3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.215.219.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1fbda8e-8eb5-4b5d-b13f-ab553a5a5ced", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.10.175.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--313ce7eb-10da-44e9-a545-2ba889da746e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.11.57.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06a4692a-5857-4e55-8bb3-c06c30e6c567", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.12.254.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--844eab2f-93ed-4544-9391-ac0ca9f1b768", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.120.126.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3fe6f66-4a33-4b28-8373-e87360eb1333", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.129.185.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1377c81-4b3a-4f08-a35f-b8a75b2fe68d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.193.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f7c50ba-d2fa-45f5-a37c-19230aeffaab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.194.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e4a28b6-b2a0-4619-b3a9-c0940c9a0fe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.194.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff084655-0a38-4972-83df-f2033be2d102", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.141.233.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e1c2e8b-0c99-4641-9ac1-f3fae4a737e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.141.233.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8335905a-fa7b-4f2d-8676-822819af29a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65cc60d3-6ecf-49f5-a203-36e0e1372f7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcc9e3f5-d640-48a8-84f9-18ade6737c2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3da4ed72-ee0e-43b8-90ab-7be69f21507f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81ae05c5-aa44-4c55-a7d3-d8bb0808efab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9907f256-d56e-4742-a3bd-06a2e6bae714", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d382585e-2d59-41cc-9c8c-a9ec58030d5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d09db3f-3ffc-457c-8acc-977d654850bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--057ce287-d6b0-4235-bf95-960348bed54c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d7efbcc-ad8f-4fdc-8f42-d4f8f9e2da42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c55ae2b-73c2-4a51-b691-74d68690aac8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29a02692-aaff-45a1-85e1-828aa45a9c91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee0777fe-bb6b-48c9-8a79-fc56912de96b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abbf8c4a-764d-4467-a2bd-a00c48a88c90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa59d795-6360-465a-baca-2de97de7b9d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8911da87-e8ba-4368-a1c6-42ca7d4b6c99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a46169-13f2-4047-a329-fbfec5a075a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc6f9b74-43e8-4a2e-af6a-5f416fdf416a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb3896df-0e2e-403f-ba0a-7f72e5a279fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d7a31ba-a3de-4fd7-b0e8-26aea50f1c96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08a6e2e5-ac15-44ce-8c71-dd3a86cf3808", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ad61ca6-c1bc-487b-9f30-704d4a5e45f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.3.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c2807d7-3c13-4e0d-9c4b-8a635e61eef4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.144.212.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea7815e4-44ba-4dd9-8edd-71badab7273b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64320a4b-4526-46f7-b89d-b1acc99c6813", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65c96377-891b-41be-aeb0-75444f4c5fb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4da14a09-4e6b-4026-b2d1-2406272b648b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeaeedf0-c2e6-48e6-b88d-6c262155a7d5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30353017-3bb1-4a3e-a9ab-b59ee5fd9420", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0539f11b-e12d-4dc3-8f43-1572e0c7d933", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29ce4aab-513d-436d-8dd2-316ef41f54b4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86b0ff95-3099-4077-bdfd-5369737466e3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8df67fa6-1ad1-421d-a8e4-3da3b9c844ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fe81b07-2e20-4ab2-abad-6e169c5e87db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd6eeb7b-4621-4459-8e5a-05661589d82f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9942b1e-63ac-4796-a10a-a7f27f8ad075", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c926194-75fc-49c0-b15b-2e6d550604b1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ef4cb23-f9c5-4333-b89c-14d89e8430c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1281849b-e579-4357-ac7f-e9ed3982db29", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--377f8d1e-5133-4f16-976a-b77b4a674305", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a6f2150-bb2c-4362-8419-4c08948547de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d909d259-a82f-40ce-9fa0-011b73ec7f84", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7352c769-9901-483e-89aa-a786522cc254", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86715198-6e3a-4194-ba3b-13268ad1e5fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6f68dea-dd08-4ddc-a3ae-cc6bb059a4d5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a51e089-3a2c-4d59-963d-a222a75164f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d78cf30-e283-4cc3-b871-61f9290da45b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f51d7853-c698-46f0-81fd-fa01c80ce1e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3a98b0b-3954-43d6-ab7b-cbbbbb61d1f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c803af39-9a5d-459e-8af8-1acc641b17f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd8eeca9-05db-4a39-8058-f619116fa323", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6127e2c2-70e2-4666-ba9f-c30cf1b3e468", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12ba9d3a-2a63-41fa-ba3c-d489d2dee0ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a38f575-2d33-459a-96e0-700b157e3d37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56359b45-2479-45fd-9658-e1d651798095", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdb5b4aa-45c5-4668-8b43-4f6d03d42937", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e20114f-24e1-41c5-b30d-82a6380f0271", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d85332fb-3e3a-464d-88a5-95a1a526c1e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03e4b209-3834-46ba-8d35-3f1f8986369a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9e6da6d-7cd7-4268-b75d-74acd559254b", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40303641-462a-41f5-9e91-5e273bed167b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45097a6d-673a-4f1e-998f-e9a6fca99be1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b92af4a-0ebc-4f19-91e5-ebee9365337d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78411a28-3c4c-4434-9434-18cd27aea007", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4b0f376-c90f-4ef6-b521-1b0143ec9feb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d791f593-1ac2-4378-8796-597f8f1e3b49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57029325-8a60-4916-baf2-3f666fc76bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6154bd55-f2c0-4b21-b580-a5db049b349d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b3d6fe3-36e5-42ee-9f40-c652bed167e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8ab8e2f-1d61-4cd0-8d8c-433b7b828aac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd4e5a95-211b-49a7-a7b6-7e7f6af50af4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.173.216.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95282ba4-5cc2-4cb5-94b6-7c913c4a17a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.123.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--616c93d6-e21a-4ddc-b428-21df5bad5318", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.181.84.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb8a06bd-0600-4cee-9065-ca83ecfd0d8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.181.84.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fd6d128-a282-422d-a9c5-e3d9d5a18d77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.192.184.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc9ee02a-ef8f-4d3d-9982-84d765045e08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--109db7c2-65e8-430a-aa9d-65d29f1ac508", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d434ec1b-e064-4b67-b866-4bf0df3c1ea1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e66d25e-673f-49d6-842c-9b208290d98e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e23abd6-f3fc-4c49-9a8a-510e61babf33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.92.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d4aacef-19b3-4bfe-be36-423e7e371545", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.92.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--237463b4-f620-4d05-ba21-014706e4744c", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.195.250.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09d386f2-b58f-40d7-a6c8-87c456bcc2a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0de540a-f7a4-49c3-b713-e1f86192bf25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f773754-bd6e-4918-820c-412533d77cc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac0b9a30-c171-4a36-9028-7bd480ab798b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5423ed47-5d88-4f78-ae2a-1c4dd4d0ba8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40db1085-22bc-4f86-8ced-aff2a491fcf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--712f3b48-809b-42be-be15-7f2a513fdc78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4197dd2b-cce1-48ef-9034-f8a4b4c38874", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--207523eb-174d-4b51-992d-cd5b85305b8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40d89095-616f-4689-9af7-dfce162b6440", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf9551b-0864-419e-876b-27888f33b8f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04c120aa-15de-43f6-9c1b-91716227c5de", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.227.254.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89125dbd-6c0e-45b3-aecc-5d9d173e6552", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.244.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de79edd-f17e-4cf4-a4a6-ee3f19e96f62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.246.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bd7aeee-b9b3-49e1-b11f-16f63d89b3f1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.247.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--432eca66-303d-43f3-b359-093bbd85c5aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.252.188.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfaed737-1518-446e-9a7c-124a2be6aebd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.105.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a2ea5e0-cc0e-492a-87e5-5abeb44abc0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.105.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0c0b3b3-0814-4c57-933c-795aa1f6e023", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7011ce3e-b527-4609-b923-6604414f3a41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fdbd434-08db-4397-aa35-d37d27689a15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.110.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--618598b3-ba78-4e81-97e5-9dbd7de328b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.12.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab49cb06-d07c-45ff-b53c-81eb29da859a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.12.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9ba3619-65b3-4097-928b-4d54bfc6067f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.40.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0eeb224-59d2-45db-81bf-aaae3e10e841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.41.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4f36934-b627-4509-b898-dde0d2d9324a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.42.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37e04868-5a12-4e37-83a4-c5191dfe2e2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.52.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04bbda60-52a3-4bbc-a32f-41affa830d0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.78.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adfb81b8-299c-4bb3-b36f-c68f380d97cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.84.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c129b76-457e-4530-ae9f-b8dc3eba4594", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.87.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70198af9-f87e-4c0e-93f0-bd570092a430", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.89.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a4dfef4-f12b-4393-ad9d-5bad61223943", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.94.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bae7cfee-d7b8-4c84-9273-43ee320636ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.95.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23f1a140-5440-477f-95f1-403649dab0e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.40.57.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd4ef77e-2dec-4e4d-a8cf-bd30e34bb0fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.40.57.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9a0c9e4-9abf-432f-90c1-86e888081ce3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.42.88.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54c8ea72-4578-4bac-881a-ce80d990a35c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.57.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56db51c7-34ac-4ec5-970d-fdbc29533da4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7279f34f-6da7-4e72-a188-ed7e98d6a2db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87281038-c9f7-46ab-a2b8-735a7d0d7d99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d0c3d78-83b0-4aac-9ac3-b13c2dfac3b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0530da0d-0af5-4fc3-9a23-c538bb9551c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.62.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d32722d0-e45f-4268-b259-e6527acf40bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.63.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--929a099f-a9a5-4739-a15d-48f1a0d63330", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.185.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a61cdd7-e30b-40c3-8693-6ae7308b8f59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.185.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97ba0c9f-902e-471b-b21d-87ceb1000765", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.100.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a198777-4707-4235-a80b-979a492a6e90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.111.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cebcba01-648f-4e89-a2fd-3e1d741c7c18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.79.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0868663b-13c2-4b07-adcd-76280878991e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b597f13-4e46-414c-a495-be040f0b3e4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd08c839-03a6-49b9-8c2b-48094ff248e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d2e1eb8-dae7-4695-a1fb-a430044f4978", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.84.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9678a8c3-b8fc-4ea8-a437-9de34af9b1af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.85.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73f169a8-a384-4b54-8b68-b892564faf7f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.58.52.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ad33e4f-e267-411b-8aab-4556646f2b64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.61.139.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b1d89e6-0e4e-46d5-8041-ed565953e47f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.63.6.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9323400-3a19-4c34-8df4-56d777e90488", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.64.134.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07ab099c-308b-4487-8a70-c0978a84d885", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.70.219.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--629d2d94-f1ad-4058-9d5b-73aca7c8f789", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.104.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72aa47fb-e541-438f-abe0-2e457534a500", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed3bdbbc-f989-4c46-9b5c-999a1ec7c45f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8733db05-86e8-4204-a960-b14fa2b8cfc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5ecfccc-9c2a-48b0-bcd5-eb501b76958a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c355df84-c1ed-4053-b2f4-4194d623e6c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.110.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c5aa794-9808-440d-b7d0-39229bcf0b3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.114.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1c76bcd-74af-4c81-a7b9-107a5025bd20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.115.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a396963-7b17-406b-b1c3-d218b4b15144", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.128.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec324d17-e00a-4ad0-be89-721aa3be3d86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.132.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96290ec3-0286-49a8-b82b-f43ff3b2b278", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.149.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79335def-42c5-4b25-b0b4-4890eb825419", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.153.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40d81562-b529-42b2-985d-336baa2ef754", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.153.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--600559f1-ca47-462b-a1e8-ccde2f2dc921", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.177.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f02d1e61-6d50-41a4-bf60-4fd25868efb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.181.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd2de106-0b1d-4c0b-9e24-c69ef17e325f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.186.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84c7d7bc-805c-4332-b71c-f1791d6821a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.190.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--862b9d0d-c55e-4597-be7d-a968ac48a71e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.191.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9677b7db-dcb8-496e-b400-12f12655681e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.192.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d288fe0-7d7a-4752-9e04-c12977e18524", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5494013c-f340-435b-b1b0-61ec263597f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f39ffaba-13fb-4b3f-b92c-17078cfd8ff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--302a6068-a809-4111-b623-0a915754274b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d761588-9bac-4977-9fc5-ed464d22a07e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.211.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9baeb7dc-df64-4a68-b7c2-63b0665949c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.225.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3011441-c104-4e18-923e-2b0627a47838", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.5.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--082d903e-3ca6-4f20-9fce-4d977b8a3d05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.67.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fe3e60d-f798-41ca-b79f-562286290357", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.82.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--938f850e-276f-45ef-8e74-e7ba3fad9f15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.92.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15b4808d-9b64-4b99-9e1c-f3e83d36f5f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.98.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--770a7b08-4481-496c-9e40-ca4b9545f729", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.8.19.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ff82b4f-6121-471a-903c-692be5fded6e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.81.148.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37c85fe-663d-4312-8d9a-1c8447131026", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33e05055-65d3-414b-bb61-ed526ee8bce4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a44d3e7-b6e4-4a9c-b269-676f62853cce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a0d9373-9173-4d82-9d4e-35dd212d0a4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed56f7a5-e74e-4d3a-b9a1-60b0b35c8b68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d030ad4d-741b-4008-9fd3-9d4b4a8faa5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60a282ae-acdc-4ec6-a049-4e23462609a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a578a828-dbb7-4a9c-9e57-b9203f4ec1c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7cec032-0d63-4608-a310-1f3f6b0e9832", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fed6088-df83-4426-b11d-457a66aeae29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc7efb9a-d39a-473e-b3f2-03159a5d8e77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11303bb9-e60c-4d30-a28a-d81ab628ff87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b97ce76d-7489-44a6-9879-4a1881c4edcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e6dbae6-6107-4f77-a071-871cd72be908", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.82.76.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27854030-5c85-41de-a710-fbeffd582c69", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.85.218.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06f56f46-5d27-4c4a-bbb0-a54154bcb123", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.88.0.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63c18c8b-7939-41ae-9a24-25c7bdfa1a0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.88.186.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d077a8b3-52a7-48df-9e8a-88143d49d1c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.9.168.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f1ce034-c2d2-4740-887a-38def563e047", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.91.193.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8209674f-5768-485e-bcb6-14fbdcd2a2df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.91.64.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9f642b4-c278-4505-9267-1bcd2360b85d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.91.64.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6d788b5-f0f0-4a65-8432-3b550e8ef231", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.92.1.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e374a3a-243c-49a1-abfe-4c3b0c4fdd8a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.92.229.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6ef85c6-50d9-4f8c-9fcd-45d2e0d54515", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.100.15.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf731525-2df8-433d-95d9-5b1c86760dd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.124.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f2e084d-bb33-4ba7-989a-76772d5a2099", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.227.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61e4b4af-025d-4671-8d73-410fef9cc686", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.234.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ad05bc2-ea85-4e4f-af3f-0d96ee03ae39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.235.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eac6ed03-060f-4388-bd5c-9980d7c7ec65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.105.132.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b29b888c-8d8e-4aff-a335-640f52237661", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.105.39.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57f299c8-fb75-4edb-8a33-1e72f93741bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.149.191.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7ec3de5-bd29-486c-aea9-15fbbf9fba5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.178.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a788ad27-a47e-4f00-8eac-98b98d9d7233", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.19.114.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--364a0984-904a-498c-a6ba-bf6165c36742", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.23.108.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d245effd-30eb-48ce-9731-af8fdfd7d480", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.236.65.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12a10f8a-a30c-4e6f-8c9a-ffb9e3eec849", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.62.239.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50a5a07f-292d-47e7-bce6-04d35063eb88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.106.120.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75e6ff30-94f7-42db-a740-b5780fe7024d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.107.112.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e90593e-3b62-470b-ba36-ebdc320f82cb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.123.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec4ac249-c253-4bcf-930c-5443eb4507a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.123.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b0bf751-b350-4913-949e-9eca1cf332a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.2.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04554756-8478-419a-b327-a5ff6e70b949", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.213.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c0c6be8-7b72-49b1-815d-65f0b4b99a28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.213.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b44312a4-a257-4a9b-be66-cd0fdcd24e88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.87.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec89fae1-488a-40e9-94be-4b8dce763064", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.239.234.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03ea455e-5512-44e8-b56a-d0a02b1dd08f", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.242.223.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--679d695f-6d69-42fc-87f3-22cbd8ca7a8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.10.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--403be310-214e-4004-b19c-7756e07a5e2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.129.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2279a348-6b47-4336-85fb-c68716daa348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.134.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbed34e2-5d07-4702-a964-ecc031e5a95f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.135.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--210adc39-c44b-4296-bcac-ac4845fd6e15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.135.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eba51841-a48c-4baa-9771-380e68742b99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.136.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35f6bdc3-aba5-45c8-898f-619779243167", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.136.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--482a3f71-bd52-4400-bbab-39049ecf7aa9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.138.0']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c87c4e3a-bbe7-42a6-993f-c38d503e0495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--271e911d-653e-4205-b960-56062ae96685", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84839620-124b-4c6c-8fd3-90469663f659", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab05f159-6291-48ca-89f9-38698b714157", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92ee5821-d0b3-45bf-812b-bac507be771d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.140.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bcff94e-7b37-4e10-a1bd-de2e4eb84068", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.141.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84eab66e-2197-4170-a8cb-45e761d68d2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.141.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--319a5214-3bdd-425e-b480-8d39524751cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.54.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e9bec6b-92d8-4f29-874f-e23d09c4d3de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.82.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--113787f4-f86a-491c-843f-64db46e40f8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.118.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9289fd0d-4751-4444-a0ec-fb00ca57a0cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.120.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c19c78-2b52-4470-bd9d-04d135a773d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.123.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c61e702c-88d9-44ae-aed0-f3eb3ddbdb30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.124.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba8ea614-4e26-45cf-97be-7cb0c972aa4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.127.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f37d99f-a14e-4602-b2d0-3338bf6e0a5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.130.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0620b7d-80bd-4b13-bd0f-7cb74d7b45aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.136.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c46ade62-6dee-48d1-9746-e7e1038177c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.148.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c0d6883-74ae-4c6c-912c-dac00e9b2bb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.150.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b5df6ae-be1b-415e-aebe-1e94cd030e84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.151.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bd806ec-e23f-4270-8cc7-7aa6235af23c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.158.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e1dcc09-8618-430d-a12d-59e1810f1526", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.161.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f9735b-d765-4578-9583-b163b7559225", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.162.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e72cca97-837b-4fe2-afd1-2ff3434a781b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.178.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--751aa984-3e4d-48f3-94d1-15cc44310085", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.192.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1aa3202b-fbaf-4d88-aedc-5288e2ab993d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.39.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3ced762-3c14-44eb-8994-98af9c229b40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.51.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1e49654-7a8d-4433-bafc-ed8d35a7af23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.53.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51bac319-b443-489c-b6c3-2bc4298a85b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.58.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e916d454-0cd3-4b84-9264-43cd945e604f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.81.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99ee6d3d-72f1-4d72-9c98-7ec6ec441cd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.82.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f39647-a377-48aa-9110-43210aad0b32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.82.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e27025a-39c9-43d1-81d3-38524b6d3c3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.83.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8458ddac-c071-4e2c-89e1-c4681c9107af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.86.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e70529e-ce8b-48a3-98b5-f4d4a0d5f74c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.87.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--975f8008-f487-4bf3-8db0-b0d8b629be9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.92.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a9e1342-6c99-43e7-9a71-7257f66059d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.95.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0b0b7d4-8b90-4407-806d-08542999637b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.104.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f117c325-275f-41f3-add3-e174580117b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.104.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3af74087-03da-4998-baaf-d52731ed6cf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.104.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfce7bb7-8bfc-4cb5-84d6-83075332f95c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.105.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e679d104-d720-4cea-88e3-541fc272b569", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.108.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7527371d-83be-4521-9c84-043550b81dad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.116.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34324676-596c-4f09-b31c-09d2a83e5112", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.119.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9437c3c5-7c93-4f58-b960-e8f00c2a37d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.124.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abcb7447-9374-4352-bff6-0709624cf069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.141.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0367e1d-038f-4e7c-b9e1-7194c86821fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.142.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baab8cb4-cf09-4427-847f-18b6c3115c7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.176.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a25869df-0bf9-49d8-af0e-026500a857c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.179.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a587da14-71e9-4845-a719-d171e8449d1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.180.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00fd6de0-7584-4205-abf9-4d8f636a1a81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.190.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39ecb842-0fa2-46f8-9d9a-dadf5976bd05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.20.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa1b7163-399b-4fe0-9b67-93476333badd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.243.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef3bda02-0e4b-4e7c-be0a-8c172752d124", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.246.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41fc7a0d-0ec8-4494-887c-385e4e2c0d0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.247.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8580120a-4195-4ff3-a6a4-698b28dbb35a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.248.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdbeb9a1-6426-468b-b00e-9c8e5a975aad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.249.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f5eadad-2022-410d-b5dd-957439fac01d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.249.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92b00ff5-4b72-4ae7-9c04-03ca1d6dff30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.250.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cfa4b03-7d03-4e2e-ad6c-f6f681136275", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.29.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7b6301e-a38c-4b74-bc57-115bba7a6d7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.48.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be700a1a-ffba-40e1-90ae-50fb3a33a775", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.51.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f70b4fd-9650-405f-9979-0db229f33232", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.74.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e04e6986-96c0-4ba6-abb6-98545e17743c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.82.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e843c4f-5329-4ab6-b9e7-b72f62155cc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.93.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--108e0cc9-d88e-47db-ae07-e758c4dd20cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.94.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf3dfb1f-0475-4714-9190-70f00f0d1a46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.252.53.96']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a065fe2-83f1-4a1b-93a1-895ceff252a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.253.5.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a28f7f7-8837-4e7e-9423-272f38ae0adf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.142.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5771f642-157b-457e-b3ee-587fb9153a85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.144.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b153ae21-9d82-4d4d-bdf1-500d24958db2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.147.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d8d2de4-6a6c-49fc-9da2-eacdae489652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.148.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4133b140-8958-4e56-8fb7-8c59f8706e30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.148.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f76f1660-29e9-47d8-bdc3-e01787b05c47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.150.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6629f8b-ba13-4c7e-aab0-2a84d1d0e420", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.156.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85eee3f3-d4f2-4944-b777-6298246f8273", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.158.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79dfa506-806e-45e1-9b85-bee61622b345", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.171.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4a16823-0a38-47aa-8c11-e72b55f7e790", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.171.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--126a3afd-ba47-4737-9876-5cc103115f82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.177.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b394dc04-65a3-4cd7-aab9-9c625de91147", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.184.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bafc46f-81f8-4d77-9b09-2f9c7f80cb8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.192.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cd0ed03-1dd3-4f40-82b5-740b66479ff5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.195.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49a0ffb9-5d28-4083-a6d7-34075fd6f1dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.197.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da21d6b6-adba-4c3d-83c6-ea3a6e9829bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.199.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--473c916b-4aa7-4789-9bc2-547388b3b9b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.201.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--428eed41-26bf-4c98-8e31-0f7f27d977b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.202.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65cb5447-8594-43ce-9c8b-d68ea293f924", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.213.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f272e78f-4ed5-4131-b906-2de2ca192ef2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.231.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66d0d25c-71d3-4547-803e-c9e2126cc4ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.234.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8f8f2fe-0c36-443a-8ab5-1ef4a72e8a61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.238.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--210a5885-06e6-4aaa-b8ce-3991102a2d71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.242.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aae503fa-d0c4-4648-ab68-5f5472143704", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.247.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--199bfcc7-1688-4de3-b0d4-86d4823fa94a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.248.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7d4e0c4-8656-4c2e-a2e2-e060b8da6e16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.253.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a05156e-1f6b-41c1-b7b7-9b7c2f711b74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.70.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5602b73f-237e-4ea5-a5de-84de9cb8c9bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.74.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e84aa6d2-65e8-41a4-8212-f2de5ea0cf8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.84.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--343d2757-9506-4bbd-be1f-bc4cdc6863fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.86.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--091310a1-65e0-4780-bcc9-5d1d39e26f61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.95.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--272bfeae-cdeb-4058-89eb-c9770c1a493d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.74.11.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dde236ce-694d-4a38-83ec-832ad9a07aa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.74.41.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61e8760e-3b8a-4b62-8bdb-d8b43c5806b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.74.51.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4ee9d39-4823-47b2-8757-cb40e21f2f1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.76.84.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58631ba0-5d45-4bd9-b3fa-b89b53dce6cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.195.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63205bdd-d2b1-4a66-8965-4a3b5bcb8079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.210.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beaf5391-a95f-46cf-b305-4993c1a255a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.214.63']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f39b9b8e-9a9b-4195-8b35-26d0564704eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.224.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13123455-72e6-40d3-a040-7ed3e400b53f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.229.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--198e98d2-c3ca-4364-8d9a-19376522dba4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.233.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68002c52-9125-41b4-b671-42497f31bf57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.234.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69ff543c-95cf-49a4-a451-90436bc83b35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.101.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f614eeaf-8fe5-4cd7-b58c-2920a9d99b4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.102.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f680c7-471d-4846-b56d-f45d3b40718a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.103.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa113a42-3e59-4b71-afe5-6735daf201e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.105.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5e0c5cb-11ec-414b-831d-f3b924ae494c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.105.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d3d3c7d-2193-49d6-af9b-763f71daba6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.105.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34cd49de-245e-4537-9551-04845468f177", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.109.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29c6f9b5-0360-4767-b629-a22bf1a3ded1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.109.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65f0d1b2-5c7a-4443-b63c-9c0f05b4a49a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.110.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f84bebf-a806-40d7-8349-bc5b3ae574f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.111.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe650ff4-f7a6-4ebc-81ad-890eb5aa12e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.111.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e04427ef-01ac-4959-9d96-d72d8eb757fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.112.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0925e459-9655-45c8-bcea-9d9e244796fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.115.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca39ef50-5d2e-4457-afea-b30b2de1eed1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.130.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ae6f2ca-d219-4da0-aaf1-2ce770a506dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.132.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdee2e53-04f6-45f5-808e-ec1992054fa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.134.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d77593f9-1728-4129-9255-70ae6194486b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.135.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e9b322c-502b-44bc-a35f-16515ccc185b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.136.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1ef0c80-5033-4e49-b3cc-57d8c5c7abb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.139.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5d11a41-d525-40a9-80b0-6452242e9561", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.139.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b88eefcc-0b6f-46bf-8011-b3cbbd443edd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.140.0']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7ab427f-34c7-4a26-9107-0dbd64070c62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.141.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4b2efd5-5e74-4292-8244-ce087ba11db8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.142.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b4bd5b5-e5e3-4418-9fba-c99abc7068ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bab78e5f-b39b-4999-a298-72037c5a13c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8ea99a9-50fa-4fac-af1d-fb0110c51169", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aeb34d8-2008-49f6-bef1-ae17fa308b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.184.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3954beee-3851-45f5-9d89-77d5397c94cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.186.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9082a38-3430-460c-86c8-66774b5f1448", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.190.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a362f2f7-d9e9-4119-93c4-ca51bc275fa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.192.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9175c65e-cfbe-47f4-a798-3393d8df1ac5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.193.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ba05bc4-68d4-468c-a76b-1d8d99a0305a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.194.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1924ace4-8604-4230-87c2-959282a8130a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.197.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02d6088a-7fad-4e09-96eb-a1515e3f4be9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.201.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd09fae1-244c-452b-8e39-16d37d8e70d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.203.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b66f9c6e-ecf2-45d2-baac-23cafaa8a3bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.204.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f5849a1-9ab4-4106-bf4e-c6598f6f8702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.206.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eaea36b-6e77-4f6b-b881-318b4e101e1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.207.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bacef48d-7dee-45db-9689-f5de481261bc", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.64.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b7f9a0f-ab3d-45e1-b6cb-b579cefa2bdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.30.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc0613bb-e172-48e0-af39-bec0e3fe4768", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.56.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75dbbfab-c230-4e61-baa1-c84b87b9bde9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.9.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3be9fa86-5137-46f9-8730-6db595ba5259", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.94.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--316a05ac-44b9-4d0d-9afc-3459d173ba97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.193.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cab72ae-5bd6-41c3-92fc-00b745dcced2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.225.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bebe4d3f-8de3-4ad8-9f94-914d20b23971", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.241.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--672182ba-0def-4fcb-beda-0b185456b5d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.251.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bafa276-58b5-41ba-ac3c-3a74764036c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.255.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb4e6d97-0ffc-40bc-a969-206cb877c179", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.1.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c1a7067-3319-4354-8a90-b2b4baab97a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.125.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5b4edac-2548-4484-aad5-7f48f4167ed3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.21.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9d0755f-3c08-4ccc-9403-616b9176818c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.75.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0edaee7b-b775-41f9-8f08-2edf5fdbf072", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.94.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd530d40-86ff-40b2-b598-e119babfc9a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.94.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd1ead58-fec9-46ca-9164-be5d325a865f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.93.81.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87ed6a71-0bb1-4851-bf79-a09cf0154bdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.95.228.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d9e267a-2f3a-4e5d-84eb-9c3808d43b95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.214.144.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5791603b-deff-4705-93d5-2668d8243e06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.214.144.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--275b2a39-8454-4df9-8d59-060d3956e6d3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.143.23.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0602fa84-345b-44b1-83b4-7199372da20f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.206.243.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b32778f-c385-4454-b01c-2061071e63f4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.232.104.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4cb8aec-be89-4cca-9af4-2024b2584e53", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.232.148.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3135d518-c773-44ff-8f1d-a5f4bccd9c93", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.89.11.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0e02ac1-6ea7-4628-8c7d-4ce6b783ad2f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.133.131.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4bcdabe-fb18-4bbd-a785-a52ff672fb29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.175.169.63']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8af1754-8746-44ef-8747-c652e357ccf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.187.35.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc841294-7c24-4f7f-ac96-2a79e6f61814", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.187.35.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5eaae57-0199-49c1-8c00-0a70befdab95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67667cc6-c55c-4af9-9950-90a6ffd2fe67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da35cfbb-6ee3-433d-a8b5-0d2bab1fdeb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.189.130.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b97e8fc2-142c-4323-8af8-cafc4573da9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.189.132.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64c207c-eeab-45df-b57a-f970fcb0f82e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0026e03-6ccc-4b74-ad0f-d235daa334eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--018a62b0-2f45-40ce-a316-ff62328d7fa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd0f538-3cd9-470b-bcc0-a3f4a59e5f90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75464c17-da67-461b-a99b-d68315cb7efe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71c6c1ab-8f25-4099-a44d-0404a08d0d35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.254.85.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c9fb84a-7df8-4d0a-8bb4-846d0a85803a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92700430-753d-4a55-916c-d85d784dbd95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--824a6954-c0ec-48aa-a47b-68edb2b1628c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9efeccbe-3c6e-4f3c-916e-1bb0741e254b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2023-1389. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dfb7a0bd-1f41-42a8-954f-716935eb8a5a", "relationship_type": "indicates", "source_ref": "indicator--9efeccbe-3c6e-4f3c-916e-1bb0741e254b", "target_ref": "vulnerability--00b841b1-a0bc-4dec-bc95-bbd0cffd3797", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4b34a5b-b5ad-41a1-b8d6-df2072ce3a22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.83.143.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57414713-1bd4-47c9-9cde-2442a2af0ced", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.83.143.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c518d2c-9606-40da-80de-fca1de137265", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.23.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80c50939-b955-4555-84d6-c0f4f974d42a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.23.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9993de4c-3f7e-4d20-aa26-2b361282eed8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.26.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae5033e0-6a37-4a41-94dd-668a7b9860fa", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.72.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62ab3676-1f32-43a4-bd8b-af6cf95091e2", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.35.168.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c616cacf-e2e7-4546-8d1c-c49eade7d362", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.56.159.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17c3a6ae-de4e-4c2d-848d-08af9a72b4ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.7.127.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0b15fdb-0664-45f9-9935-e95674e31b86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.205.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f913a1f0-919d-4566-ade8-1d0c109a59b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.205.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec0c45b7-d35b-4e0e-a733-b870af22477c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.104.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dba91ac6-7254-4a94-9e1d-db93ea03c546", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.110.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30258be1-413e-49d4-8051-3adf42fe8895", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.111.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5a411f3-c00e-4458-a116-f70f8b811a70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.255.204.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e4f3fdc-2fae-4423-9f5d-c78956958e76", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.255.66.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aaa1eea-d22f-44a5-b2dc-f0ff67142021", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.107.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36ab2aff-6241-4d92-a728-d0521f945f45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.91.111.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3cf4ebf-0375-45b8-b329-3eebd2eafa14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.146.88.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b993614-bf0f-4b3b-a3a5-d2b46a843954", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.146.9.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8002a538-f537-480c-a5c1-d2d07c4b6739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.15.79.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5977bef-50d1-40f0-8249-f2fdc04a7db9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.82.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c252437-bdd9-4270-bb59-d5b9cb6b3731", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.89.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--239fcb30-4388-4937-bd67-9de7566fd96e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.89.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--525bef1a-1fd7-4f1b-8d44-39686d745c25", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3f90b7c-7d65-48a0-9d61-7524cc3e844f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bd94530-7166-4bc7-a217-f97f1b486e0b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f69b89b-0667-4aee-8fc6-2a2113ea4b4d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1208cee-830c-4cad-8a23-3504f4bb597b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b466789-9534-4912-a0ef-d00334f5e6f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42216151-4115-4e2b-9154-731c2998b4e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6999449c-9378-4c50-a180-9a7bbe7c460f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72df54b3-efa4-4765-81e5-95b055878eab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ce52094-c269-4fc0-b928-1378eca5ced3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--983a62b9-7601-436d-b9b3-51c2c8d90f96", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07da5971-c450-4caf-931c-d5d336904e3d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e33497f8-03a3-4651-b481-3f0d7ce92e5a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f601597b-ce1e-49f8-98ff-361f25bbb454", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87a08e5c-f2c3-4b3d-907f-c78c3df87305", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c401be5f-b6c7-4df0-82f5-b2475172c5e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--541613f9-87da-4989-af3a-37c592154e2a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed299a1-ae41-434a-b5dc-e7bad01bb395", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8debc819-7d3f-48f9-bcd7-93067dcd3af3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--672aafa4-a419-4771-b83a-eb9afba5bb25", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a943d3dc-8701-40c3-9edd-32f1ba732473", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87088714-2d38-4f07-be4a-e484312b65eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bbb3bb1-d858-4688-8275-a95a9454826b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--796008b7-17d0-4ea0-9f69-f0f5b02eaf9a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--754baadd-2d20-4e98-aeca-c8245f4cf660", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94bbbba9-8cb0-4843-b47d-6a088ff27094", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc1f6fa7-9a06-47f8-85c4-e53d58ac762c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38bfdf3c-13b5-4225-badb-f73c589123f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91a5b888-a20a-4bb0-b372-37848bcd6ab1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd54b1df-2fae-4203-82cb-e8031641f110", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a70ec9d6-2e23-4278-b4a4-7e2dc73f3a62", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c8ce3de-e0a8-47b1-8c80-fd9b7d765099", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b2330df-ebd5-46d9-8dc5-0ebb8c3254e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54e97c99-b8c6-4638-bb37-cafaab7df193", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c818378a-692c-468a-b7d3-b58a7a75c2d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--590483e7-12f5-4585-a750-95c0253f4854", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.182.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8264fe5f-98e1-45e2-b8f5-d066a010f071", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.188.189.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0949b59-86e4-44ca-8ee0-e1b34d06c91d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.188.189.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42c26e3d-78dc-4882-9f22-11a08800ea8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.188.191.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab0cde47-47a8-4247-834d-d25566f61e69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.188.81.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19cc9d0d-1266-46dc-a479-570441ed2b4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.20.198.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f521edb0-bc29-4d14-96bd-4297b80177b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.21.227.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb6aa49d-94bd-4a05-bdd9-a99312217556", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.90.252.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c20bbb40-921c-4b4f-9d66-7b282b94af64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.91.2.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6842296d-4b44-45da-98de-77527f9efa3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.146.189.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42e3009d-e4a5-4660-8553-c5a9a055a011", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.152.98.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3df7d132-a548-48b2-a188-3eec68a4c725", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.173.154.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ba82e93-a8a9-4aa9-99ad-e2d3561a7051", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.173.210.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eff6163-5cac-41bf-8170-183b8b1d7473", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.176.79.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69d49fbe-0a01-4217-af0b-3a976e74b083", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.211.104.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dea59a6e-ce77-4881-a158-8b2bd18575a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.226.19.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4102e357-b6c8-40fb-9dbf-695741cdf0e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.234.201.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--554b22fc-db24-4b7a-aa68-b3421788e279", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.38.92.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddc3af7d-e451-4f42-a89f-56924a016ead", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.87.144.255']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6350f8b-fb78-4126-94b7-74b2f091f3ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.90.143.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb35bf47-97ec-4295-921f-ac2de33d5263", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.92.193.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6f12991-6bf8-480b-b016-1c4c3d9b6735", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.128.184.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f09ddcd-8e07-40e9-ae42-19fea9287a84", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.6.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3295fc4-b4de-40a5-8a39-5ebc18649f73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.151.106.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e0cbe4f-3a0a-4f53-8eab-78f1acbbaaca", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.186.20.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb0543d7-dac7-4018-b626-907aa0d815fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.20.236.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1839c78f-4494-4db6-89f7-07c4a497b4a5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.42.8.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c3812dc-aaae-4c4f-a7ef-c036a332bae7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.50.204.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8cac18f-8ba6-4a6c-8e67-562e7fb8774e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.69.183.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecd73a6e-9ea0-40d0-9d1f-9933fa03d358", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.98.197.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d97066d8-ea1a-4e88-8a26-a0fa2f17c0f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.126.224.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbc8f01a-7c9f-42c0-bd79-b0246d95c005", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.90.69.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e66526e8-a222-44d1-a611-18747744dad4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.98.69.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae0c68ca-f4a0-4cce-9df8-77b2b78df081", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.13.7.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac1d5e57-d270-460a-a4c7-46100bcc38b5", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.173.100.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c2241d2-13c3-40ec-bc58-5aecf3ae474e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.173.83.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1076624a-6d13-4d6d-abaf-dc177fedef1d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.177.88.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2be3226-7100-48fe-9744-172fb1b16967", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.182.231.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b77430f7-eeca-4697-ab63-779b88011cdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.191.125.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d674c669-f51c-42fd-ba2e-5c3faf36d17f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.8.79.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea8e81f7-e872-4976-90bd-a01ec60204b1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.151.249.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--022837ae-8167-4ffe-809e-e8fe76b19d32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.171.151.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3432c5bd-0db7-499e-8356-9de1d6b5305b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.199.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3624358e-1e5d-465b-9304-a3a56b1e398b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.246.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4dc51be-c7ca-42c8-8298-e03fa06b9ab7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.38.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f594981f-60a8-4dd1-b188-d94cc878bab0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.54.176.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7241bb68-1782-4504-aaf9-b8eabb681a26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.117.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22ba58f0-7569-4a7b-96de-d6fe5b99a248", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.162.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3288b32-0279-4a57-9dca-6cdda180c6c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.165.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f841780-b483-4a78-8c06-f525f71d12f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.24.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--681e997d-502e-4330-92c3-a8192ea91bb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.75.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21e30c7b-a329-4c97-b702-e04744459975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.76.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78d3e53b-2654-464a-80e2-91b098c29788", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.82.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb2cb903-74d5-4c52-86bd-3f763745931b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.97.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09fe448c-b42e-483d-aac8-7dae1b430a17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.209.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed394c0b-33b2-4d13-82b2-676c393823e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.31.32.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7615bcf9-b080-4500-b2c5-3fb6c0514fb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b42210d-aa6d-458c-9ee3-cfc404acb780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fc7b584-3a9f-4aa6-8cdb-adbff27b0fd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c2158ab-154b-4f00-af40-baea05fd9132", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f41bf254-9fcf-41a2-aa84-24cc3cff1205", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72115934-4ebc-41d5-bd16-b0bb0c7969ba", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f79dd9aa-d977-4ad8-8aea-7a24d91d5794", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d66a4de9-f9e8-4a97-b54b-a5dfbcd61fd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff980758-e883-47a0-a6e8-515bc1f0c866", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5f1a713-a48e-4c7c-b80c-de3aa73bcfe8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--205db2a3-9dc9-4a5d-833c-b42fe67c0226", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--189ad14e-4778-4d69-9f7b-3482d7b73906", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85abaf5c-eb29-48d9-8c12-6cf1e51457fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fce9ae9-b29d-458b-ab9d-b5f1a0e6d568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abb164fc-34d4-41c9-81e8-1dde6703fe7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdb9b4c3-3789-44ec-b0cd-0592dd3bbd52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3373faaa-86b1-4dc5-ba6d-08402307c6ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f95aba1-ff3d-42f2-ae27-7c7009d36d3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c88eeb-e7c5-4ca3-8c23-f0ddcf33c812", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1982a2a6-e961-4df2-ad08-6c0c68b7d5d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--254b6df8-b08b-4dfb-8fca-cf883afab1d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84051fb5-2f14-4846-bc71-12a515b7ade3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed01cad6-1aab-4d8d-a69a-51f1b0472ab2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.172']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b534d9c-cd13-4813-90d5-0a377a8d740f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7267186-3dde-4c55-99b4-942859c495c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8661379-eebd-4906-a94b-7932cef25639", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3149b6a3-bbdc-4897-9386-08c707136ca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f38504fa-1a48-4aec-80dc-21cad88a24b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c3d4f38-a99e-4e2e-aa2c-b936d5232e75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c4bc376-4a0e-42ba-ae50-40b604ddb254", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9f71cfb-a317-4fa5-b035-ca4fbd8a9582", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a878c5d3-8834-46db-a799-41dceefb3d04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efe3ec43-3dac-4abc-a5cb-7c53dea9313b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--324acf69-5fc9-49e1-9229-2636a029113f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed52a6b1-b8cb-4f10-a274-fdcad9dc2067", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a5513f4-0ade-4ebc-9cf0-418bbd4b52a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9551a54f-4ea4-4a6d-b2a2-9cbf92b03753", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d739e62e-623e-4507-abe5-5a5a8b3800cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f08a3b34-aaba-4114-9e95-e94ae5cf3be8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f9f586a-d78a-406e-9c49-8fe0434844ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fcbb345-2683-44b8-aab4-8ea6fe6d1d5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68e4b591-b399-40b7-9289-7319b2eae22a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aea157a7-972e-4b73-80e7-6744395623bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32b20927-291a-4778-b95b-0f331f8cc68f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e07accc1-cf36-4482-a082-dc5e6619b00e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d98d0c9-d7ce-4738-981a-5a3df8bce15f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9431273e-dfd2-4540-89ee-04e9272c1b9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48c8b3b4-668d-4565-810f-3d14ae7bcd0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a146d82d-08c7-453b-9cc3-e5fe83a65ba2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47e08287-fc5b-46fb-93dc-3e79590d1d59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b666484b-e964-4a3d-8636-65535508556f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3757d4ed-2734-4334-b0d9-f373da60b7e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0120599-688f-41b0-a526-d1448d9d87b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68a7fa4a-91cf-4db7-9aa5-1f45f63e9dd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--030688b7-f69a-420d-97d3-a24b3cba6c6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--455abdea-addf-4705-8162-491e8d4146f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfbc623b-05a1-445e-8fdf-322bfb14b1a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0559259-e73e-4c7c-ba98-4010500e3052", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.101']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3c2ddb5-a87a-458d-8a17-a74a29343802", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80952aea-14fb-419f-b0bf-0f4486e8d8e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e88429a6-3b0f-4c58-bc39-5716d599a356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c1b80c1-40f7-4e71-ad2a-551a5add953e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f5c4d59-3ecf-41ca-8580-98aefa61e76b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eba7058-fbf4-4d09-96b2-989db3e58b0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a038ab9-e567-4c43-8cf5-8018594c1fc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d753c2e-f476-4df2-8316-b266069d4f63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecbec1f-f7f1-44af-876e-638aac3b9fbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4a731cd-5789-4b9a-8aad-713eb571ef16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70360dac-750a-4991-80fc-1077f359ef3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--758ac1a3-c0d2-42ac-afb0-8c377346a450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d93bb361-b4a4-4a74-80af-5b3fc0033983", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f48625-0ee7-47b1-9766-bf2b026fb69e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f73dceb-f87c-4e51-a0a1-b3591596c720", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39286495-3d28-4b7a-abe5-037dbc75ef84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7567796-27e4-44e8-ac00-8272c6dae934", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca0a189f-567f-473a-a918-553878d49b13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe7a2847-f940-446c-a9ea-7ca40e5c3de0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a2f7a9e-5272-418b-9c7d-d5b03b71b4d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5a7345f-9d0c-4a07-8154-c3d121d49336", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10c87911-5c58-4a78-a6c4-f6c0ab0f0138", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55fec52e-8f5e-4c25-9268-6c89493209fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc81ddb9-09ec-4a7f-bcc5-d12dd8fb3097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcafb6f7-340e-4894-a052-e15847a96877", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b898534-2e8c-4d39-899e-916fcd61e9b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e53a344d-45c8-4611-aca8-9121d5e20399", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11ce32ee-aeaa-4745-8a5d-5ca825139ace", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2f1f4dd-887d-41eb-b314-507f954aba78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7af2ed73-4101-4697-a6aa-5913e50182f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44bf49d5-5205-43b4-b7bc-b4df765ebab7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15e0ff45-bc92-44fa-ae24-1537c32cf2e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e96b8292-a393-4d48-9286-cb4f7974d8fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--133ee5c1-8963-4c65-b9da-fb6644243292", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1728935c-47c9-4f2a-80f9-1cd74c30553f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a01dc6c-6b2f-45da-8d8e-b75377265f37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55838c0a-a471-42e8-b083-d933038b9f1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb08fe09-4bf6-40db-a72f-e6344752fe39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30a45070-c9ef-40cb-96b1-906bb142ed41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e0a89a3-118a-4b77-aab1-a90bf5e2a829", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f142241b-da30-4467-b7ea-54e6b23fd8fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--626ed23f-1c0b-431a-8f0b-b270110d5904", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6025ba8-3050-4343-86a7-bc9b8735b167", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cdbc129-3554-43bb-a7ae-9c973a2b0fee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bc55c8a-7633-41be-a564-a8affcab354c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--427519af-b3b0-4697-a034-7ee3536a9563", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d101c22-1bb3-45e8-ad2e-b41cb0bda5de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d25a812d-5a8c-455b-a338-b8ccd3649295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22e4d6be-6666-4fa7-94e2-e70346006b47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--834a3f9b-cbf3-48e9-a186-b76381cc04c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f314531-08a6-48d8-8cc8-85dfd152772c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--564ad651-1dfb-4fb5-a44a-9aa801065ab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58751697-dcbc-4990-832d-8064b9ce28cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25b4b8e1-c2f0-478a-be82-b2e9de702e16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dfaed1b-f1f0-4bae-aaa8-4f9f03dc25eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d67d2c63-fd4c-4c13-9e45-b45478cb8647", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20411aaa-a624-4c20-ba1e-3c84d9384f82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16b0fe92-237f-4ba7-8e03-0300f2e153cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bddcf2cd-f53d-44fe-9475-13a91572597a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.160.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b251ed12-2e68-44cb-9cd1-d6757744ff79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.162.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc0a826b-6e48-4828-b01c-ca463658f8a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.162.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--489114e3-1967-4716-9aa1-ea50561b9d33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d216770a-a4b5-4a52-a8fb-723cc8623b56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccb4dbe4-9e69-4095-99ee-82011a0f3a0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8afbb396-6680-4e10-8b2d-016a594d9317", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d2c8eb0-556e-4dcf-b037-063d2324e853", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b74754f4-dcdb-4934-a3c0-615847e33003", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f880835b-c025-4d69-8e19-4e03dcf8e62a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--032b4e7f-6607-408b-bc71-ea386a720841", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e78c447-ac27-4454-a54d-1ce01b5e8f76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10378ba2-8acf-4955-9f29-3b3044c46df6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9d669f3-9254-4daf-9343-8659ad6d12a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7ed7fdf-1d7c-4cac-bb07-290d4433732d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c78a8713-5233-449d-ad7a-a2896fe5bf32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b27616a3-af0f-4370-a8c5-1e29e1986105", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.109.228.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87552243-d089-4bd2-ad67-a3ab50af7cda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1ee15c4-cde7-40e6-9627-5782b1c91972", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b363405-3302-4f71-921a-a27b2cbbdb05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bbc2fc8-1607-4eb4-889d-6962e4ec6756", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.124']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee13ba41-2919-464b-a5a4-11aea97ca7d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3c14e8b-c100-4a78-ae07-ee37b67b4331", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5616794f-0559-474e-ad46-9f5e63e60295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77f20a77-b5a3-4df7-af3b-3170d4224942", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03026854-6490-427d-8285-e9add5cec9dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f94c4cdb-fbac-45fe-80b7-76d00eebe0f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc7f710f-9ec0-49d5-98a7-d2ced339ec08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfa0f7d5-8380-4a1a-a9db-611fdc60788a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d1f3393-c946-4fc6-a8ba-d4af0d244f58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbbb1c80-12b2-455e-9f2f-a7fa34e6110d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--342749c8-9382-43c2-9468-56b8684fb8bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66b2fd9b-80d3-4d60-9f12-1d7a120bebf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97007689-5c40-447d-9530-75f45f341431", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6d20c07-480f-4d6a-ae50-a52c4d4d3a75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1638c56-9488-41b4-83f7-9c370c1aeb34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--221d5259-4b0d-413e-a0a9-35f7e19d85be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8c544ff-9011-4ba8-b010-838c3c26396c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--742b7e8d-8e21-440f-b22c-59571124ca06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6b370ee-0406-4450-b3f2-40fe1b06ef05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74408aea-37cc-4f0f-986f-257779a10ea4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2cae3ea-81ae-4836-a0b2-9b1358f7ccf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bacd56a9-df34-46f9-a0c0-5dda24cf74ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a690a50-86cb-4e1c-93f0-2f35bb291d0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--827df13f-6f98-4199-af41-c15c7e03d196", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17b11b69-2062-4ebd-a361-f3ec05550fc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c870ef0b-542d-4dc1-b015-ca927c3a379c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b0a22da-eefb-413c-b9ac-23353a4ec15d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78a6635f-2084-438a-b909-6495b47433d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45991d55-2069-498b-bfe8-6d321cef7691", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--381c9cf4-6ad2-404e-87e3-f728d24832c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b8f5407-e31f-4415-830e-f61a9158ab55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6ab6c79-23a8-4af1-a49d-1d222524f56b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b99130b-c664-42fa-bda3-04a4da960e48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db973404-171e-473f-9542-7ff7040de28b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee35f8f1-97ce-44ab-8c46-dd59a11987ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33b3449a-667a-4598-a6f3-d8ac6661f271", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07929e2e-4ad2-46f0-91de-9ac6ae41be66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39dfbfb6-b816-40e2-a72d-637ac8a06ca6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1cbd55a-ad5a-4b15-93a7-1c9a0ba74422", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b7e87d9-9c97-4560-bc06-78f5eb9af203", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0de1d33-2052-47e1-8443-e613cb191fc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51991e77-b74f-4c86-9e15-42c8cea14b1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--795ad1f4-a18e-4add-bed5-09b67c440a8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06a548df-b895-4801-8a9d-4da57346fcc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f358dcf1-c3b8-4c5c-b7fc-fc0d09e00831", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b220d4d4-02dd-4f25-8986-a676ad591021", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e857a9d2-8ec5-4686-b808-2728067b8067", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88d52929-1627-45f9-9b05-1e4ccdca340d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c197d81-048e-4899-a877-2fa7a517f2bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce460f4f-f621-4dea-ad5a-a3d653ef2d74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55b8a452-1017-4de9-a7b6-148ded1e715d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7202e57a-8765-4d13-ad0a-30cfedc1dcbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0ca4a4b-0954-47b9-a700-79b27fef4c9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f0e5358-4c73-4d6c-a3bb-25573124cec8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db88413c-ac26-4981-ac82-340a24aeae7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70425bb5-1877-4231-b342-0ed8d385987f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11f4ac6a-ac04-4af4-b2eb-7cb36ba8a4e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--704d3c8d-ec78-4aed-8ad2-6af4aaabc072", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3dad900-4063-4395-9c56-bd631499b007", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e16520b0-66ba-4413-a373-af31074d7a05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56e054e2-ad24-4f0b-b0e2-5c5f1e25414e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02be40c7-56c0-46f7-a8e2-14c57ce271c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--281d7816-b6b7-4186-ba53-2d5bcc74a4c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d012e707-81db-4c7c-8d80-29f74b73912d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--438257db-8991-4568-b338-27978b25e1e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5969246-8b1e-460d-95e8-8836009e9403", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20b5c498-547b-4b32-8e20-aa6a2b9a661f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0305b60-e2df-4626-9e06-b27f370863cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28b1b429-2ad6-4bdc-9631-618a37f79721", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4051175a-a980-491a-9130-afdf4bdc1bd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fe042c2-0944-4efd-92a0-2f9ca48b8d14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85b9a972-6e04-4272-a1a2-5ea67f661d47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d9832c6-5e40-4eef-baa9-3024c64445b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70f884d8-7199-4e90-8e43-673e8d4cb067", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2e5a79a-9318-4f50-a936-5c1cd6dd3d22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--540c5c61-07cc-4529-bf19-bf9e30fc5615", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69e6d25e-babe-4c7d-83b1-7364bbee5f7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1562b0c8-6c8a-4ba5-9ac7-6f74ed1429e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3ac3cdd-9c74-4579-9288-76811af04d52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7403430c-7bb6-43a1-a14f-28df1e8fb305", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfa7073d-fae0-44a5-a639-aefecc7577dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ab12922-8d27-4cd7-9d23-8ea6a63eaaaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28139a38-2062-4666-8f89-835f161b041a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69eea157-985b-46e1-8e66-e285043886d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05473798-f93a-48b6-989a-f671fd089555", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--892ea142-9c22-4d24-aa21-38e3021af154", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--383b79e2-154a-48be-a738-b7ef5befa047", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--402c46d1-303c-4341-b7d9-cf63d9ac9f95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80acc271-41fd-43dc-9cda-a34a88196a55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a90953a2-4172-49d9-9757-255ad56ad1b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba069af8-a57c-429e-b62f-7ec8f2c9ecc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--956bc7ad-a1c4-4596-8194-d0acf9097faa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1856a8d6-b9af-48e0-9c63-fd7c98c89c9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3052abb2-e2e8-4126-81f1-b2e1db6ff94f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.60.5.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--894fc737-43f5-4e58-b281-088fa610a622", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.60.61.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1a31da4-216d-460b-a97a-08e6d3b4f77a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.60.61.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3b9048f-bf8e-4daa-8c83-e1b9b4ecd0bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b146afc9-a0ef-4728-b48b-8bdd0c88ec65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d17b27af-0b72-4264-b0be-995f230ab25d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02e3591d-99a0-446e-bd22-f9f4f7635371", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efaef0cc-f2c6-475d-84d7-00e6048ee631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74c0f5d4-b5b8-4652-9f8f-c8ab072a9143", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3aa02f8-43c0-45ee-a8f9-f7794b2fd7f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3daba74a-7c1c-4110-bd78-62f778b1a364", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b7be389-539a-40bd-8ba1-bda76562292a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7e34b56-f55c-419d-8437-6aad93b735fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9258288f-6e44-4a95-a9b7-170848d868c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93bf81d3-cc10-42c5-8ca2-38acfcac75b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94f4cc34-6160-41e9-9025-c0c961e5e834", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f0a87a8-e369-42f6-b6ab-dc39be55c839", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa363664-9b86-4df3-ac94-ca352543b6bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d05fabc-b4eb-4942-bbd8-f13379fd8912", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00345625-69ed-4cf8-b206-920517b1b405", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98a830d2-a807-4abf-9055-888c29c92486", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fa1fe63-2a80-4cbb-aed0-52a24190f973", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f568f8d8-ab2f-4270-a546-60f3695c3d57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--551269ef-b416-46f0-b863-92a31e3f6f19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f24e107b-f641-4b54-8e45-d8ed0e821d54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b9c0dbc-17dc-48ce-9ecf-a93737e2b010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--762f1fc6-0738-4436-95f4-f4219660db13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b38380b-e683-4acc-ae5c-bb85dd29ed77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--183e3323-3929-4d6a-9b9d-aa634a853ce6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.188']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28e34560-40b4-4e5a-a78a-bf024aa77271", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5ffaccf-5b61-4979-8261-d1ddfbb081a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--619a47fb-7b8c-413a-8dd9-f445d090be61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8a99570-ebd6-4d45-840e-7ae1f78e47f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1137e604-1327-4498-b72e-d68b65bcf238", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1227ba86-e6db-4a53-8eaa-780b4cf0eff3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9f22462-1cd9-4cd0-95e2-b09fcc5173fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d66ac1d-aa48-4884-9022-060b6fb39edc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34594492-fcd1-433a-9bf6-ef5df8dd7991", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c0a2dfd-6cf9-4183-af19-9f92500bb45b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e95459d-7559-4c7a-a987-172a119c193e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9409cc25-4328-44fe-a0ed-d3057a6419e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4785beae-4db7-4c6e-88c6-46ac1d664121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4146b0e2-b43c-4930-af29-52856fcf9006", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcb1209f-fcee-40d6-b857-371cfcdfd7de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2111258d-5d33-4005-beaf-c0c409439c74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--289405b0-e47f-4420-a97a-e93059ac9b4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f0c3fcd-d077-4821-9756-964f166e99ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9083f9d-d4cc-4f4a-834c-9bcc610235d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c888b3c-9c5d-4d3b-a4a4-0aaa844169f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8bec432-87c6-4de6-aa29-206362205a1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e1a4c90-f2d4-4809-b838-4aa95c23376c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6d4d764-298e-4da4-8a8f-f6c4be989daa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71977040-84f9-4dff-9f75-6a8151f14d24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4802a66b-df47-4202-9224-0935c5f4799f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a29ff5a3-3dde-4ed4-b39e-8dea559bcdb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c96c16ac-81cd-4e9a-9a08-c5048665f54e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81d02b8c-87d1-462d-af64-869e202d4f7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a2d3b6e-80c4-4665-92b2-b627e395bd4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95b7c3b2-6d0b-411b-8c70-923f0b0429ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f34a6ed-ff26-4586-ba3f-65296b8bfe6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48176c24-ce90-4603-9207-8f214eb6b913", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d17dab10-7f21-41c4-8a0a-b49666ff9dd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d2c0a3e-f0cc-4323-ba2b-bd9b1602076e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcd9b46d-7741-475a-beb9-2cfd12ba2e7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab94728e-068d-401d-8ddf-98077e50d7e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adf86590-ee39-4620-80c6-b10da85881ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e959885a-c2a4-43e6-9f05-c44baede4ba2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab90a8c1-fe42-4cde-9ba9-ca27ca53cb59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--925c1dac-9549-4285-af7d-1ca4d960b4e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1b6b22b-911d-4e51-bb0b-77601ccba919", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c4f7298-28b2-49bc-a4f2-db314560dd83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31fe6212-9449-4c5d-a98c-45e54a4000e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d199306f-dd26-4eaf-ad5d-fc59d480acbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd67bf77-2a83-466a-8679-f0e1a6712121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b580f1d1-eb8c-4c0a-bb80-9a32c0d809f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd129672-011a-4b74-93aa-120beb2c8d68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--692fc93d-43ab-44ce-9a0e-1ccba10eb827", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52326535-cf72-4b75-810e-8db09ba51abd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f08d76d0-5364-4709-b1b3-0b5cdeb87da4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45070300-c0a4-4500-9dc7-4ef7b6899382", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8da30bf0-e593-4e60-be6e-6b2a3dcd3583", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e69a39dd-7788-4483-b17f-0b70174c8832", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73140334-8153-451c-a0f8-8a8c9b9bab58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e0eb72a-4078-4dbb-9a05-7ec46b1e75c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--391ca9c8-9df4-4581-bf58-0418dbafc092", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--576589d7-59ba-4bb7-af62-0fedea10eead", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b26fd3f-3447-465e-bff7-1aa101944718", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--371ccf5f-16a9-443a-bfcb-c1adf6d2b8b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--552937b5-b334-486b-842a-cf03393ade1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c582c3a4-7428-40eb-a854-c31502301382", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60c19246-094d-4186-976c-e92d9cb672ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--184285f6-2462-4a4c-a4e7-b4874febdecd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.252']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3be93231-209d-4a77-8cea-7d6ad683cb2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81b9bfdb-8afa-4674-98fe-81c047b5f4d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b6b0a3e-ca56-45cc-bf44-1da4c487194c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e4a77b-a2ee-48f5-aaac-843e9e91c7a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--069d68e0-5e97-4ae1-97a4-785ab6c07e9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d181f463-3937-4d5b-885e-f8efdd4995f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--265ea406-0be0-4188-bba5-f861c97d9376", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18e55ae6-b1c8-4cdb-9096-9d8360ddfcb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--471d67f7-dc6d-4557-b1f9-497ea5e0ce2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed45cd7-e606-4c48-a281-e6589e88aff5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--437c31a5-a758-4bb1-a97b-8a9eeb805ceb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52f3a7ed-0321-4f3b-be2d-b486cc8a1043", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd15b92d-d702-4657-a3e1-bac84546af08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--838b9b46-8c6f-442a-9667-062717abd07b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd6dccd0-68be-4995-bdbd-0e6959fc5db3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a102b487-2025-4600-8f32-f2bcf8615111", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5a89c1e-4764-46ff-a612-81244d599308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef252171-ba52-4899-a99d-e21229a8dd5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--584e61b6-6666-4063-a85e-1528fb42c39d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00e8b925-1237-4248-a70e-ed6ba2a2c501", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6215002-e99f-4f8a-8cae-2fb200d036e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6f2560e-4ee0-49e5-903e-4230f31f09b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac4ba5d5-0ef2-4e7b-b6c7-d46b0bea6c53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c104080-15bd-47a7-b2bd-b3881dff01c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df0467cc-6c50-4260-8989-20a95d2bff80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4a0249c-c160-44ea-803d-059e669e89ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--452121bf-2975-4e89-b91c-95c2f8fc1c97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32630211-5e02-45ac-b2a5-23cc087667a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e394ca89-1327-4183-8b9a-8427984a8d82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d768cf2d-ee60-4e94-ba5d-76b39f0d53d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ccccc99-4536-4d46-aa0f-6aee1fb16cdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d402b044-aa83-4237-a43e-e22f8e2ef61a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0539d89-1fcc-4178-a6eb-83824731d17e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--427aee45-9af2-493a-a23e-75e168827568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--497f7d02-0b90-419b-80ef-d0fe2da0529b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38cd04b2-abfe-4459-b7ab-58844734d251", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2254de6f-7e2d-465b-8e0f-eb70ce3114eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b826e01c-bcdd-44ad-8f2c-51912c19d42f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--931d8462-fdf3-464a-85bb-c2a9a6fbecc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f029f54d-db8c-4c9f-acdc-932487d44e54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b160b060-1b42-4bd4-8269-7ce24598ab75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dc54017-08a4-4ce4-b690-a139afd5db8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.212.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--601b8bb0-345b-44ed-9c35-8d5395f3414b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.220.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34db0edc-b72b-4b10-b71e-de7b4ed0d739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.181.171.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--111ac6c6-ec7c-40f4-a410-ce6215f1613d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.212.187.214']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8125fda-36b1-4d2e-bd23-9b6460d415a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.38.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ef818d-99a5-4d51-a3c1-a513ee7a01e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.40.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--853c6783-a852-4f3c-84eb-8d59016e33ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.41.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87b92d85-ceb5-40cc-94db-3de9d5b65ffd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1df64c8b-6997-40be-9c6c-832c6c3ab7b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da1219eb-8e14-453b-b3ae-f626f0533005", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.192.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9a78c1a-4684-4065-98d1-cfb42e331e89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.192.82']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28bba532-e9e0-4b90-b04c-07b97891660d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.205.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6feed76-eab6-498d-ae1c-2c25cdae87d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.219.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46976b1b-3e78-4a0d-b699-9264f0ecb03f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.223.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dc6e5d9-8ef3-496d-b168-0c2a09caf7e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e17ee65-cdf5-4238-baa9-53f762bbba88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3642f0d7-49ec-434c-82e8-7e4eeaa04e4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c59b07d-0140-4cfa-a3ab-5b4fedbae636", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.76.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--082a242e-6372-43ad-8d95-a3b7d194cc91", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.77.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ce721c0-1ada-4439-8a8b-7111b638762d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.79.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--442d121d-b6d9-48e6-98ba-69c4bf418a06", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.79.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7c9af8e-dca8-430b-a5c2-dc7e14bcc586", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.90.98.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92938efe-c892-4589-8a82-4c529227e340", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.92.2.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5538726-c815-4af3-beea-8fcada5f0e34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.94.100.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3108d4db-3811-40ed-a7cb-89b8423d5ed1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.138.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--569a328e-1cd8-4e85-a1dc-60282d461306", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.149.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cd5f9ff-4e93-4023-88ff-c748cb436f37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.149.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4212eb5a-fa9c-4aca-a2b3-16db28761385", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.160.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91b20a9d-a927-46a7-bada-2113b5c815e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.191.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3a8f042-4633-49e8-b37c-fb6517eb5cab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.123.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b303f58a-ea2b-4bbf-adf6-ca735c84e056", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.199.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63502d4a-db85-4f10-ace7-4465fb1a593a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.22.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b77c8c46-ff65-455d-9617-bc85f6cac0bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.229.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8efe4e88-89e6-4e79-8082-b8ce89c394bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.24.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ca4d3ab-cfeb-4412-b7c5-d2e90fc2e52a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.40.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e3bf827-944f-491c-b6a3-d0cf2cb8fef9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.61.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16373cc3-39a5-4323-9623-ae157986b745", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.62.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d5a3277-ca33-4110-bf02-44c09196631f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.69.177.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52e8530c-8c48-4dcc-b742-f0290fb4baef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.164.214.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b1f7c3f-9447-40b7-ba9d-09cdea9bbda9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.175.33.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53d8c0eb-cdeb-4040-8274-380b8ce74013", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.175.92.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6451574-83a2-4886-89d9-6d83ef789389", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.0.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1612816a-69ad-4339-a08b-8554efe8e242", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.100']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f38b4aca-d2aa-4063-b408-ffcaf9281e12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f43b76f-d7bc-4abd-a45d-d359631cf9c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce659f41-efb9-46b2-a950-37d841de32d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.104']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17db70d3-3dec-4c7f-8aaf-b3032acdb614", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--500c4829-08e8-48c8-9de6-f5961dd9c8ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.108']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--245a3f9b-6c51-4f33-a93b-afe8361a948c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03a9fdad-0fcd-41b7-8862-972669ef0813", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a55a57a-bafc-4d15-8046-4b7e4ba6a01c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b42d404c-f8d4-4d5e-89b6-0d2e87a9978b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e1c2a88-f17e-4113-a3b0-17e8bce55c4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d058e3b3-b13a-4354-a22d-2924f2d802c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01b6b9e8-df6b-452f-91a8-dd750b8c9e85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff4d17e8-be78-4786-8679-2015e3e417aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad1be81-f5ec-4ddc-bc9b-1d7c92a77b07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--596f3e55-c7b4-4117-820a-f0a3c17dcff4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dc392d7-a452-4f76-87dd-89d1d0221344", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb085b8e-f58d-4645-86ce-6d5b7286b4d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.120']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94da9b80-cfad-449c-a518-050a51111aa6", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22ab5e5f-b2bc-4e3e-a010-c1be496c9467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--530ca227-e34d-492a-a5c0-4c1cb4c6a86e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a07b2c1e-3e30-4641-b94d-dab6a2ebdc3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14564db2-e049-47df-ad92-cc71b1635300", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e343d8e9-4556-4500-8d27-df17180c3ae0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c66155f-ffa5-41bd-a30d-b657b63ada8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5815880d-eee5-431c-8d07-d7acefb76975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b73afbf-40f6-4a50-915b-50df2d39aad2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b46b20c-37f8-4a43-b299-4a27f98fc4eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12fde477-b848-4912-a2a1-6d206a051535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ebcbfe8-fe44-4c07-b126-4189b9abf5ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d7540ed-4587-411f-a15e-4fa834bc3df2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11f3248b-ad26-4f3f-a052-f4df110930eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21caff11-263f-49f8-94f2-81f439194fa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5393c3a-2b5a-424d-bdee-471046a1c89b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cacedcb1-b5da-497c-aaae-7112275044af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24601f6d-6479-4a4f-ac45-3e7ee2425254", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29a474c4-45b0-4a3c-b773-b0c96e97fac4", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21ef9a40-b2f2-4c28-9657-d583005e9806", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--166c0ab8-445a-4fbb-868b-21b20478765f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7929afd6-15e6-4491-b681-e4ef4557196b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29dac5e2-873c-41f8-a083-aeac4385f3c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aad68db3-df0b-4470-8e9a-8cca3af43862", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.152']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c890d16-a226-4492-8654-b64cc2f199ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd218a2-da24-40e8-9db1-62cfecb3ed99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31ec3895-3145-4740-ada2-e9f9fec0ecfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54cc4d9e-ffa4-4416-8ea6-8d7b6320f43d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c6636f7-3c32-480e-bd6f-06f76037baf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.161']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9101897-5344-466e-90e6-08f36f95005e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3eb2f54-2d38-4376-b050-df245077ba57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd1ec12a-e373-496c-bda7-b3b7c3a59fb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4464e1b-3210-49af-9ccb-e360d089508e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b976b03-73d5-4489-a631-8094dbf32c7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2444a02e-bc3d-4000-817c-8ed38c000af6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29a2ad1-de9d-4bf2-b94e-325665bf8cc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd1e24cb-3066-42ca-8f3c-84b4a38b1af1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3feba1f6-98d1-4b40-aaee-9e39209c7526", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--954061a0-2524-476b-b325-251676a80a02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.176']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6006ee47-96a6-4ffe-8350-ce602595bac4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ae6cc87-8b4f-4d48-9a6f-14aef347e1f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed9be5a-1195-4001-9330-f6a1ba512cce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0956f976-b6ef-4c25-a44b-aac76308edcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eb4c117-f641-4040-8d3a-510feeb4d0ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abdb42b9-cbe5-40b3-9fb0-bde2bba0287b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af171743-1d9c-4044-a6de-ff24e8d02c1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16241797-43f0-445a-aad4-ab0f10dee0b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f651682-1358-4076-885f-18194abb90e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8b59b85-0455-430c-b745-ded350b00fd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae3253e1-3b3c-4237-a15d-96c9cb15a37e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f5fc28a-dd09-4a73-aa73-c679abb46088", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513b0f5b-b711-4834-bce0-13ac6dcfce90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baf46adb-2451-438b-9718-4f7cf94283d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fffa9e97-fcba-4bec-91a3-33372adb84ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da6a5ee0-d76e-4f91-8d64-afecc9eea716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c440a33c-e22e-4b04-a9a2-766746d74867", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1a0a5cc-167c-47da-98b1-9150c13e3b31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--226369df-4fa1-4240-9150-10e485909a81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59633f11-1a69-4b21-982e-0185cc28c224", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66c0727b-d533-49a0-ba21-bc3ee5660047", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--479de9b9-aa68-4cd4-9e1e-4803f9a08ee5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37ba4c1-e37a-435b-8ea9-4c1ae820ed40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a81af731-0121-4881-a1da-42d8c116b5e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82905ac0-5070-4ce8-a2c4-208a99613097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79854266-7431-47bf-afdd-fcb291c94e71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6ad8979-44d0-42de-9856-1cb94fdd409d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecb9c9f8-3a5f-4e86-b8db-b57e6643e301", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--721b005d-82af-40b2-a225-2bb89c03d325", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbda5b5a-9577-4222-91d2-01934885f725", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4280e76-854d-46f1-b1bc-e3dde100f318", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.216']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d1c00a4-0980-4990-a308-cb642bace130", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7678040-e10f-440c-8243-2c707c1f3060", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.220']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40b24142-8c93-49aa-a1e5-b35749d08ea5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8ea911b-a4e2-4a16-9a91-3359894dd531", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.222']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1291d9e6-d8a5-43a6-bc51-c6a716175f7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41d1c20f-e769-4912-8c53-c816aa50a3b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.224']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4093df85-b093-49e5-b524-39a82e9bfc2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b521db7f-c585-4caa-909f-d11d1266e067", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4beea254-22ce-4862-9f05-7412c9995e94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--264253ee-b6d2-4404-9b41-0888f8142ded", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebc40f43-8bd1-453a-b606-7cf60a2d9cfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d02ba130-81b3-4808-a6c2-897c0de0c81f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0800ce0-04bd-45db-8632-06d611f814d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53a2e099-0a15-48f8-95e7-1195dc914b09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5301236b-6df5-4868-8fe8-db403738cf7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e0033bd-6b29-4a67-902b-8decdd81e695", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.238']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06d9f358-5a92-4762-93c0-9d304645e97f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd498d61-3229-44f7-abf8-fd3a8d3158c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--173da9c7-1a31-45e2-985b-4d3f60ced437", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4900650-f194-4742-8f9c-7bb3edb6a39e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.242']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--736e95c3-2363-4f01-b2b0-213942e901dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9b20524-f937-4886-ab67-e9dbe789a6e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4809040-906a-47c0-9c30-ef8b1f44daf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa679349-59eb-4c6e-b335-97b2f51da2a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad543e1a-5ef7-4929-9fc3-3198e8d0de6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85831bc3-1e06-4682-aa5d-2e0db2105022", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--621a8048-9989-4d93-848f-c8aa6fedfbba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caea7fbb-ac79-4486-8a5c-5ffc01464f60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1978dcc5-40b3-4069-8b38-658e9847a2e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd3411db-3ab5-4f93-98b7-63da4ada36aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1047f45b-e927-4558-942a-7e5da5717e5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c43c61c5-f4de-45f9-82bf-2b6b9b730d60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53e885a0-5bce-4d9a-bb70-c558185c244a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7955c1c6-a135-4b8a-aacb-9a2988ed832a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a213f85-6989-4161-bf29-9cfd9b2c217a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc34b90a-4c2e-471b-bd89-c71e0e5a07fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11b28e10-ccbc-4070-af18-f868ee81979c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4909ffaf-c804-48c4-b5e6-233ae647c476", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ba82344-f474-452f-b180-98101e1a70fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00873b45-94cf-4030-9853-d112594a49e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--473f7b76-87ad-4087-82a3-f0dee5d4ede0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13e02552-1fee-47f5-9478-5f927a8d3ada", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf9788b2-350e-4b6f-a82d-91928f37d2b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58288f53-388c-4ef8-9fed-746136a3bb31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0deef58-e660-482e-95ae-b83d99b02373", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63dd66be-2a42-47e1-afc1-73e50617d1cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cd00c2f-8071-4c88-802b-d7184b00d877", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d30c5b5c-1d01-417d-b422-4edc9941ca36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13f818cb-693a-4203-9778-805afb03e3da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--137cb117-5484-41bc-8db9-adbb66707377", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d35344cb-9c5c-463d-82e0-9ae8c16f2387", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baab5081-17ff-4c9a-b48c-dce044fb1142", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd8d40a5-6887-4b4a-be8b-121c296d2213", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf7480c8-9d25-4b6c-a55f-c660c305fa87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76b433d6-3f10-47de-b385-ef14017e40b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8912b7b9-8557-4489-ab97-873ef8bf7482", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91249dfa-d446-4aec-8572-3743927ab626", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37d1febb-df0c-4a61-a9fc-9f0ff3f59b9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab29aa93-b20d-4cf1-994d-7299e4e2ac30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8de5d46b-7bc8-480d-9af1-ed4948f6d319", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--015e165a-e2b3-4490-91f4-7ab8ad875901", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79de2e8c-87d6-460d-b146-c9b1b04e48c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c256ced-b296-47dd-a722-e2ee42ed8f3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b00f9782-2b14-4bf7-8fbc-7f331a99e5dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dd7615b-ad1f-4bfc-9cdd-b2d72bc75424", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04c1476d-7c06-4b70-a522-db27114453b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5d2a290-c241-446c-b37c-5e39e1ca6284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07185f91-92b7-47bc-82fb-9bbae82b9f9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcc64bb2-7efc-4433-bd18-465dd359c9b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c396f63-0f61-41c2-bad6-d0186e019fca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6012e345-fc7b-4766-b310-999a60ebbbab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d6a1be-dc89-49b0-8c50-5d4e8c3185bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fa5c4d7-7158-41d0-8aec-d4be5782e637", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--547f36fb-805c-4f7b-b4a2-c06436eb7e99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a8ec5b8-447d-4200-8666-af6ede7add45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83c3b974-1b7d-45f2-b48c-44919c183cec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--571c0fac-c51d-4387-b1d6-e5bd9b044c63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3674bc49-eaec-4a7e-b9e4-f6b82b1502b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdc75a06-567c-4a0a-b8f6-6adbb9e88b1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66337d73-6ea4-462e-bb88-bb7edb77f623", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--558c4e3a-b1bb-4fb4-898f-6064e7fac72b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.63.64.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0228eba1-a7fa-42e6-8ddd-0518b7cdaf5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.183.226.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cde87674-63ed-480a-93b1-29d77d6a1e08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b82daa-b718-45a5-a3eb-8a3b55acbe34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e727204-c0b0-4895-8c1b-2d1eb7345924", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f4a6b19-54f2-4e18-bd00-94e0a881015a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d739128b-ac80-45b1-a0b8-b1053d1115d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f54d8002-4256-4c34-b8c8-f7c7387a3c6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da7856bf-b60d-4d79-bf87-2fdad6f0155b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.135.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad3a25ba-9acf-41a4-931f-4161ac76aa22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.147.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9723c7e2-27dd-48f8-844d-15f3f6c8b2f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.158.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb471fe5-5df2-47a1-a902-65352805827c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.165.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2e19fbc-eadd-44fa-be97-885d76ee991b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cd7d46f-73ff-4969-954e-1d70e036e1c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f2593c7-503e-4052-9188-2af8ad0f4bf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--409a56fb-bc53-43a6-837c-dbe63c052650", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf43e3eb-6924-4bfd-8a28-3929bbaf229c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6aede53-9393-478f-afed-59d7439b1f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3343c511-256c-4a92-9952-5755bd8c9b7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6efdcd29-33ec-49f0-93b7-6b5fc567c133", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2ec3145-f5ad-49fa-92c6-9b80efa2e974", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86b1bf17-a53d-4790-aaa9-cd3a0a82d9cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e959117-72bf-4fe3-95ae-3d4061c28928", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da2b0108-7111-432d-a357-a251a69fc8b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5f6cc7d-7109-41fa-a6a0-852edc973bc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fe367bd-82b7-4455-9ca4-c93d0d47a8bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.167.224.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37cb155-795b-46e6-a27b-0f89a0506d34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.207.253.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a9f218f-7a16-4894-b287-9c4a601f8b48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.208.190.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e1c3172-eabd-4861-8041-edc0dbf14b70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.107.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba87624-78ec-49bf-a0ae-24c5597b3366", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.162.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d38e8802-51a5-418a-b707-fb4a41ca80a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.203.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c42f8703-3bc4-4fb0-8783-bf2d7040ae6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.128.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20af586f-c133-4daa-93f5-f1063225af28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.128.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f4b808a-b19c-48cb-be24-5d02527eea1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.178.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea885903-8880-474e-8d9e-f56ca35276f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.178.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ff17c90-8e1f-41ef-9a8b-a7e783acaa77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.48.69.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--618bb2d6-7546-4617-85c5-fc89593e1cdf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.243.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ae9e701-2028-4bc5-b543-ea8072f01899", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.244.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a0621c0-1950-467e-a07e-d16a4d3b6882", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b8fb425-a2e1-4ce3-8696-fee3d019d4d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9713a81-495b-46ec-9596-f8c0785b0d8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b2c1f5c-6caf-49c0-9a6a-cbb10f8631c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a0b4ada-f174-4fc7-893e-3db7a28d6cab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a579bc9-bfb3-44bb-839f-3b2dfd40e36b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de8dbee-bb75-4417-93c2-bd2812ad27f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcd11208-a66a-407b-970f-d43acbdaaa91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67f5ff97-a69d-4fef-a7ab-79dec3f56ee4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dfccb59-f163-4f47-85fe-9d6768d1843c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--357aa6a2-4d9c-4d0c-b367-afaa6c840344", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--744bd5ed-102b-4a9a-a455-46d42413a03b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c38e8cf-58ac-4514-ba5c-91cc050b3e00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50af1f7e-1999-4d5b-a24a-44fac7b81c59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e55cab78-df2b-4270-93a0-b516d11930cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fcf461c-9637-40e1-8662-3b9973121a19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32e4a9b5-fb7f-48c3-b679-feeea710984b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfa0427a-f23e-4a17-84d5-d86a03b30fe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99770e75-4b74-4ba9-856c-6aae61158b03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '76.32.109.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40a52801-3c2f-4d05-b1a5-385b2767804b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '76.79.213.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b06b9725-8275-47df-8257-e3afe79f29ef", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.105.161.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3b8410e-4077-411b-9086-8e7e137dab83", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.211.147.232']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5a3a171-51a4-4ced-a679-c03e04375863", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.25.143.76']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23f89b11-89fc-4138-a37d-55c2777a8c5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.27.143.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb2a3490-ae50-4834-9abb-56070e0fd83c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.42.80.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7705e650-a4a2-4f14-b7b0-9699ade03fe1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.75.93.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ef96fd2-6716-427f-b863-4e438699a423", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.240.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3396092-b2ae-4abe-bb34-19f4e0dc4ce0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4237a841-a197-471a-b098-ef2ada33f0b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--308f53d6-cdc9-40db-9544-5d208bc5cad2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3646a3f0-0e63-465f-9dd3-830f0556da3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a07c71d-e2fb-4933-b592-561f09707c3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a15ab67-9f2e-455d-9cad-edda07f0fd20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--654491b6-c9a7-42a4-bf42-d459d88354a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.2.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cf39933-eb71-4f71-8647-ac0f32af6b06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbca49ef-3d86-40b4-a70a-ee938144e6ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1edd16e-0e98-4f49-a9fd-504a6cd5f059", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b577850-e674-4fa1-ad58-ba677e831151", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e52a2b88-7c64-49a3-8497-b19924a9a72d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--836d7d20-596a-4c38-808f-28feb49bfe52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e029ae8-7389-495c-bcec-93ecf7042eb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.112.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bb3d4ae-d118-4322-97b1-a6413fda1b83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.112.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80425d78-5432-4148-aeea-8ccd78e81b77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--835f33c9-d70a-4ee7-9101-87acc7fdff28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9acbc3e5-1dcb-4858-af58-4d08c5c2256e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20245f0d-1a2a-4b8e-abe4-b0098f38b5dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4218731-55a6-4d7e-8808-4a4db7abb2a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--179a9ce4-bd2b-41a1-b9f2-8f93890186c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30ec067d-80ef-4d10-8abe-b3864301a618", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4825ab03-29bc-4736-b1a8-e9b8312e5aa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.159.131.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d2dfba-10d0-4f84-87e9-91bf9044b611", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.44.192.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--648359b3-be06-4e0f-8767-b8183edc96bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--262f1b19-add0-4e5a-9635-0365f5d8410f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.162']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc9f78c9-a64d-4f71-af54-ce96d3768ef2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2021-26855. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0ad7d1b0-35cc-40a7-9e76-83d8e593a826", "relationship_type": "indicates", "source_ref": "indicator--cc9f78c9-a64d-4f71-af54-ce96d3768ef2", "target_ref": "vulnerability--308f0a38-05c3-4893-bcab-e6bb9056cbb5", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0201a83-b234-4aae-83f7-1d0ed3485ae0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc0df5aa-a27a-40fe-a40e-560d5442aae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caa9119d-64c1-44b7-92e2-cbe8bbbbc0e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2542aa34-cba4-4c6e-8091-082b1fe322de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7697cfc3-5f98-4b3c-9e51-463433745bd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.56.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36df2d6f-3dbe-45fd-951d-f8874e726c47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.58.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25914643-bc5e-4a2f-9984-40842d416c72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.60.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--024b9e67-cac2-433d-b18a-fd205056756c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.126']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59a7271e-a7e6-41be-819f-643bde529c45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ea6565f-ab08-4c05-b5a1-8b8131138a52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0485d90b-8f9a-4596-adcb-b7eb103eb325", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c5a4c16-e362-4fb6-932f-fe804e84ee94", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.172.16.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b167c99-8349-477d-a700-829d01606a1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.236.100.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d55fdba5-3709-4ab3-8c24-ec747ef60a8f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.36.191.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33a50cc6-bbfb-4974-babe-abff967b0806", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.140.241.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4c1c854-23c3-4912-a930-eb51a340948b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.148.79.192']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1de7f20-c648-44fa-952c-73fdd7c3561f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.160.116.140']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90d93814-8937-4bc5-befb-e2e1993ea714", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.101.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--382772b7-a4e4-43d0-9721-bd802519f605", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.102.92']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c485cec-a1ca-4fbf-900a-6a969820ed4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.112.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81d7f38f-7132-48ce-bfeb-a01c2b5925da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.119.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef2496c6-78a8-43db-a886-d440f1e44895", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.127.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0091fb7-4772-4b31-85d3-bdd1159709e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.212.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6005e7f8-9329-45bd-879c-7c97cf996e5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.232.122']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9d33cc2-ecc1-4754-b378-616a93360ef3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.237.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c88af83-a104-478e-8bb7-d5222febb10e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.89.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df11089b-9b21-4ebf-a4ed-83530082ae11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.96.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcf9d972-343e-489d-90f7-cd335490da36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.149.255']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6840911-d0a7-45fb-bf9a-9ce31173b33b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.152.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--091036d0-4113-49eb-92ab-8acbaaecb858", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.153.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--def78c61-d2d5-43cf-b0bd-dacc2f35fdc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.157.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--499b22d7-7417-47cc-86ba-ccf2970f2b19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.167.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66437f74-e12a-449c-a2fb-e3a90d49d20f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.24.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45740999-d8e1-4bc5-8d3f-299db32f6e51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.26.230']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80c1939e-b139-4967-8412-31df9bed80e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.27.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ab3cfb1-2c83-4836-b064-2491debaf7f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.32.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d05a342a-e403-456e-ae9f-259ce60ffbbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.41.180']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ba41d6d-e958-4d2c-a3c8-f32c4a5823af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.44.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfb2944b-647d-4c19-8a42-0859f7268df7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.46.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b78a6e6b-9b86-4446-9237-4df06c2226e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.47.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1e7ba67-4d42-4bc7-8b56-659a2bb4a1b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.8.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5a7da88-3c66-458a-bf0b-49c061c1e30b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.9.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1d24843-5aa1-40a3-a131-424af4d5f90e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.213.47.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b95d5916-f203-4365-85ad-14b7965338c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.1.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8104973b-fe12-4975-8893-2e6a8e9d9828", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36ccf1bc-8ed0-4d87-b45f-77478b5169cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fec981d1-269f-4e82-a33d-0155bf4fd9ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94f5a776-b5c9-4a71-ac77-76914764aea4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bf90725-0e5a-4629-b113-5e469135ec68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d5f05f-cf30-4417-81b2-d1e3090eb8a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.97']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--affe4e7d-2caf-4174-a9b0-6bb58d7cd574", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.2.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d341d2ab-ed8b-4d44-9155-24d910a13345", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8361231-0e28-4446-a4f2-94017c700126", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68185905-4237-4085-8512-9bc2b850861d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--904cdf80-7e90-4fd9-9310-78bf1f79d0ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.234']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e171792c-a902-40f2-8ec8-61231cedb762", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1308341-c688-4fe5-8a4f-5fa8c0d08961", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fe73960-10bc-4831-a49d-a3959e253190", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.86']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af18be4c-a2f2-4e52-8f4a-bc48927846ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dfffcf8-847f-4d95-aad5-29139034deaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cace368-6a4d-49fc-9c5e-aecd92cfbb7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.6.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9840392a-34be-4ecf-8e41-6f32eb2db091", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.6.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebd9d2a9-23f1-4e18-a715-8b78c156f900", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a59dc39-fa55-400d-b9fc-59415ac69247", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f71c8efb-1a70-4d03-92da-f26a2dffbd99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07562221-2950-41c3-9a17-81c2521da310", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe9d5896-6469-496c-8dd8-61710e4ddbfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9c8b114-a6f8-4437-b97f-01e9ebf2804d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2832b82-fd4c-44b4-bb86-a7471e49933a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13f99934-a9de-4aab-b643-6f6b3a2f165e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--562ef2bb-b802-4004-9617-f486d7897f2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.246']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50b0d52e-e5b1-4838-9960-ac8976acee54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea119dbe-30a4-4072-a4aa-47d30ce440f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.100.182']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--072ed90b-d3d5-46f1-825f-0fe69b6e1f29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.106.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0623dc9-b243-48fc-8253-61b7945f9284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.109.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--086b844b-3cec-4eef-840f-1e0d2f917f22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.219.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6dd1f7d-181a-4482-a98d-9fbb93494d04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.223.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c2d9ae-a019-41c3-acd9-38604cde85a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.75.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52983d67-f77a-4d34-94e6-7272e6069b09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.96.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a63b6fc-a569-4269-8ec5-aac76aed9b74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.222.177.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--609c3375-d8a2-4fdb-b200-8c4dde30697f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.222.187.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--960aebc8-52c2-4014-9d42-5230f6db3779", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.222.188.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75145f29-a91e-4c66-af21-bcfa87c3e52e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.222.225.103']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82612007-9bab-410f-8d51-a53f6c567e59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.229.81.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2945ff2e-5447-4938-99ca-ace4b3eff1b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.230.112.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79c01960-36fe-413b-b952-4ad210292b4e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.30.249.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--966ca0c0-bed7-4af0-a3b4-76d123b7e5af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.66.83.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bca1233a-9ada-4b0a-bd71-a6be7a51d351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.66.83.80']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f71d4c0-dd4e-44c9-95c2-b5093674b332", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.70.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a1645c6-0212-4779-9596-c2b71058955f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.70.228']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51a6008a-d90b-472c-95dd-c996d7ad2e13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.77.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc4b9ac0-87e8-48bf-8c5c-c0c1ea439c24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.87.206.94']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7031a9a5-2100-4f36-92bb-892a220826a7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a739eeb-04ab-4c4e-92a8-8cb9f6a1fc96", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.165']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adb1052a-e030-4a44-822d-912e10fc31d3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--792d3fb9-e71b-4e0a-be02-2f7158eccf88", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9640caf2-1c86-435f-a294-783bdfbf3a00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19baed13-7a78-476c-bcce-a4a6db167569", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd6d9fee-9bea-42d7-a12b-b9c963301ff8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--234cee7f-da56-4059-b738-311827e5bc2a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.184']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e9c0a4e-ec95-469b-b2d2-a41c00ecc9d6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31cd21b7-cdd7-4f88-a136-486f51cc1d45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e608cc35-c9b3-4d6f-af96-c9e73b6dd4f9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--973d527b-f782-4c5b-8228-f55029d46d91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c50456f2-facd-4a18-ac20-b72505509d1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8614ae82-0ce5-42d6-8577-5787ac0515b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.137.231.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33931926-74dd-40dd-8dd2-6a945dffcd6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.177.101.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10b9cd1b-3ea2-434e-8a38-5bb255468223", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf0f1f12-005d-4e8a-b7a2-d58544faf54d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a312d94e-4073-40d0-9e6e-4b970777c452", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--336ca4f4-570a-43b1-82b6-b951e37cb996", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.192.46.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45243322-3a4a-44bc-9925-f8b89c1ed340", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.193.159.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10429da9-f288-4966-b747-225d6e58eb07", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.21.9.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27261638-8859-41de-9950-419015e515bb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.211.72.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2bcec94-8101-41a0-9f3c-e891bf44990a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.216.32.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03128a2d-12db-4e1d-85ee-6f3982ee3827", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.28.167.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfbd767a-cb41-4f82-b6f7-55c250184fa8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.62.135.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f4338a7-450c-446b-97c6-602a4b972eec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.153.246.240']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95919f86-4005-4d8d-a654-81aa188a422d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.165.129.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de8c052a-10ca-4529-86c0-838cd3868968", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.165.92.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c7bed9b-8996-4ea1-9f33-710ae702a06a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.64.200.144']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f60619c7-6a42-4bb6-90d0-23f6c4273f18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.217.209.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a606f6-a802-4a3b-8b6f-02be2eaeb73f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.224.138.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3459761-46ff-4098-8e4c-540e65479b88", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.235.16.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64a88d3c-3c53-4deb-b5d4-e26c6ffc371b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.200.16.99']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--308d219e-7e31-4863-8ad6-e9d4aa526995", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.200.33.226']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--809a825b-42d2-43e8-a0a5-3b53b0103eed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.201.20.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eb14d31-f005-4050-842c-3fc9f03214e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.246.209.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--835fd7a2-bcb9-47c7-8749-42ff1c43e8d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.25.85.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b40ebf5-24c8-4969-809d-9e03e4e8b94a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.54.3.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9b40cc9-baab-4aec-8049-f2f995316564", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28b8b9f4-6078-4b50-b2dc-01f3aeb5aae8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.160']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--080a2fd0-7d03-4a8a-9b36-75fd0a993eaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c352fde-aa48-40fe-9d0c-8846d29aea64", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.187.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f31c94a0-f043-4775-85af-b8a1a396d2bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.203.39.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f890a11f-e775-4c72-9e5b-754b9a60c07b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4aa3f06-aaf8-4ec8-b63c-48c908a552bd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cd89b50-ea2c-4396-85b0-ce469a4d3a17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49f63a12-3d89-4aad-b8f7-d64cddc820fe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7033952-f3b4-475a-9aa1-60345390db32", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b22c3c43-70d0-4db7-9957-c8edd54ac4eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebd948a1-dd26-4527-918b-b241094fb56f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de0c4faf-16ed-4bb8-8468-7f471f8a5718", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a81ef0cf-9d9c-4125-8f62-7f311b745a92", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf30aceb-34b0-41f1-91dd-d3c6f8f6ff89", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6acf5e56-5f9c-40ff-8260-4aead2466787", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16de91b4-765b-44ed-8e64-79e9b8789c38", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fb352e7-e0ba-4ee3-a1a1-169906f5d4a8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88e15bce-efc8-402b-9087-6a3a812c24c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8776193-5f59-4e4f-b0c2-0c39993ef280", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1a90308-51aa-49b7-a571-7dbddf871ec0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44526c00-103c-4af0-b302-9c3d641b112a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fb6f04d-5e50-412c-b533-be732ed635dc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--311db240-b7fa-481c-b2cd-f8462b430ff0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b2a5b04-c84e-4a0e-ba7e-b5b27055ecaf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--811ca14a-f94b-4116-acf7-43519fc29b4e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bc35ee8-b882-428d-847c-caccc29b6f5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c96e73e9-9392-43df-8a8d-e308b23e6a71", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a85bd43-2918-4611-9f3f-b38a4a9be3cd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdb9d905-9fa0-4c33-93dd-47c775ecae73", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--348f475f-ddde-4f44-a2f5-9956cc5de757", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--436786c7-4856-44d7-9c3f-1b1314d6a747", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21bbdda3-b589-4a6d-b789-3ee70ae76ca0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12be6228-ec22-4cfa-81a1-86e22bf13658", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.215.181.244']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db994d76-220c-4894-94c0-4d96b82a8061", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.0']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08f6e921-56a5-4f79-8828-9ffc85bbf38d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe294192-121e-4c09-bd4d-1e1fe362d708", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1dc8de2-e5ab-4acc-b644-9a3d1ae99319", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--238656d4-6b92-46e5-afed-c74e1e1025ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a19e2274-eef8-49a1-b204-97e8f4981209", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--681d6638-5dd3-420f-ad9c-f77331019348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.14']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d46a1b8c-ed7f-4c02-a5bc-1ae3707af4d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--795afcfb-1798-466d-bf69-74b655b0c84d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.16']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f590494-521b-4f43-818d-2737b22b28d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dde6bfef-49a2-47be-b185-02627234cde6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.18']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--671ad937-815b-4f6a-ae7e-690a8d3fb801", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--352ccf2b-2ad0-4a4a-ab28-b2d1afc2f77b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.2']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9d2d5e9-2a4a-450e-9db5-0020cfe2b6c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c7b6333-0d9b-4faa-a694-5f3f41e2d112", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b93403a-08c5-46b3-871e-1de8a43338e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.22']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69faa605-17fe-4cf0-a5df-6689b810a256", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c043cee-23ee-4bbd-9999-ee88e18775ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.24']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6dff4a3-6559-4a54-b83a-72f6cf20a56f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ae811d1-f185-4eaa-9889-9a9d70e2de33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.26']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90ab6038-c602-4883-8499-27a03bced308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.28']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6037278f-2be2-4861-8ef3-88b5f42b8ef4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--435d117d-7902-47a3-b334-88e433472848", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9304773-b555-40e1-b042-2cb641e3425e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.30']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--401ef890-3cb4-4267-b596-7e3c6596fbc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43515fc8-dfc6-47b9-bf71-cf67d4e2521c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6117ea07-53e7-4681-b9e2-91dc63c5042e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e769227-b5f2-4232-a6e8-dfae9f69b24d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f801ae59-72df-46a5-b23b-3d234b6ec5f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad259d7-cfd3-4f8b-8958-dcfcc8053d1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d7c0c8-1ec5-48ec-a30f-eacf5185795b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5c9dd36-abb5-44ce-939c-e78c0984e6f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c471d017-b765-407a-be9b-d252b65da630", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2754d34-42ec-486a-8008-cc0500253ee9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.41']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a409d9d-43d7-460b-a6c7-7e994ad8e180", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fbc10af-7497-4051-a451-8fb97c828eab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.43']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bcd2ce4-5739-4c1a-ac0a-9e1cb14e07c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42d6aa88-4d6f-48c0-8ca4-d1a40d659b07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.45']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--336a9d0e-b9bd-42b5-ad51-878ebe794664", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f90fab5d-5ea2-40eb-bfb2-fcb221179b76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.47']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8f77770-53a1-42fd-973c-809b82e7fb43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.48']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd52382e-5abf-4138-993f-264f70edec89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f921a4f-5e16-4791-8c48-58836787ea21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0933a186-4e50-43cc-af70-bc284fd3fb0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.50']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecb386e-c8e0-43b3-9b39-ba3be4fcdf70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.51']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30999571-1299-42d5-bdc5-c938811d52ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daa76482-7ef3-4e7b-90cc-f61fb84f3652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.53']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30234ad1-1136-42f7-9f9a-c4ecc0785912", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37c775eb-0f6c-4785-8c1f-70d6529541a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.55']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c9f4c8f-ef97-4d9c-a6de-c62693c8077a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.56']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3676bdd8-f202-4f39-89aa-751495c2041c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.57']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26b12235-729e-4c2c-a344-5df573b96bd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.58']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69cb6586-e591-4490-bb4f-9969ee035e8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--049fd92f-7c3f-46c3-aba7-49a8f23e41b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.6']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--288b64b7-18b8-4b06-b4fd-bd58d518231b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.60']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--892c5cce-fecd-45b8-8792-d4564b58c7d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.61']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8f28075-6c54-4b11-8d24-35eec3b49508", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c0077cb-1ec3-4204-a933-0ae4d1f6c49e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.63']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa9575e4-2997-49bb-a0e6-d4a64c9cd4f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ae8d6a2-2c90-4529-b32a-051f7511ebb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cf68c46-1f4f-40d7-9563-c6ba6a07f620", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.66']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2206885b-05b7-4345-86d4-b4bad010b0f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--417e1f30-e587-46f8-8e37-898f2297773f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.68']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eca7dae3-1f3c-42c2-b0f0-d3194f493343", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12ab234f-a163-4f4b-8aed-093bf57d82e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab4dc09a-b819-4c03-bc7d-e5ea1f826da1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ae697aa-0957-4603-8ba5-af55e092bcfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d873333-a9ee-4fa4-9528-d5c6bb426d00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf54e6dd-7bbd-42ba-9690-7723b6ea62c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a36915a6-280a-489e-b958-12ba3890fef4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e79c79d-c467-41ab-a66c-ecf359c509f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05ef0f96-4a38-4f8b-b4d6-c5f4e33f4aa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88c0872b-09ba-4813-afee-fe5aa8c94e3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.239.151.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62e91885-1a4d-4736-8823-188c1f0231ee", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.5.148.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6f9d1a1-5049-4146-815d-d3621bfe11cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.90.246.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8197bd42-8a1b-4004-9a48-c9d25b3c9c1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.111.187.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eadb743d-0056-4f20-b6d2-f58e7372949e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.111.187.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de892dc9-29d7-424c-bf5a-2ceba5050cb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.25.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12e88bd7-c1e1-4ac3-90ca-24425208c929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.25.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c043c2ba-6af6-4a3f-8782-118e31827275", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e89be40-05ad-4ab7-9f73-e85cb5602f3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd9739f4-173a-4130-883b-f4aa84103e0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddd894f0-1eba-41f6-82fd-cc68d7c81521", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.38']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--581c2066-9edc-4e80-8945-5f82a2d90547", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.40']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5a0533-bb2f-4421-942e-25128a2e9e63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.44']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fb6fec7-d4d2-47d6-a1b4-c79a2ad3d306", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.106.230.72']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4389cf46-c3ec-4b93-829f-79189ce9a343", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.69.138']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d0d1df1-01ff-4387-a7ba-6ee5b4d00906", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34be71f7-87ce-4945-9b72-b65de68d33f6", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--558e7a55-7c7c-41b5-80b4-fe1f48637bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.249.134.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1c12d04-84f7-4e69-b391-035c6d74720c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33bd6c26-b747-471b-a468-eccf4f77d1fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.156']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ea5ef5f-5f39-4fff-88d8-0ac78cceeb53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--051d8ef9-b1e9-4833-8e6e-beff692f340b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.158']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--434b47b6-9f24-41b5-aff5-f6f5683d6df2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.147.30.59']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6db0ff85-097b-43e1-94ee-cabada6fdbda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.175.75.20']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26e18753-3a93-4490-8a8c-b89d0326abf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda7320a-46de-4d15-842e-7a37085295a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.214.24.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a7f8b42-5748-434e-85c9-33e6f1385dd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.214.26.142']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ed58160-7c03-4213-ae1f-4f97b05b84e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.236.195.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2bb07b3-ef09-439b-9399-ae9adc7ec9d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.80.20.49']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a7a19ef-690e-43d6-85bc-8da9c8e4e77f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.124.113.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d16e92a7-9d77-4f28-88e3-d19aed85f767", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.130.37.190']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a248aa0-64d4-45be-9724-eeb5bc1f4778", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.145.166.198']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d26fdcd-8c8c-49f6-837b-bda71e1e6bae", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.185.81.112']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffc34a0a-c9af-4555-a3c8-b52c0a8f8e5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.190.156.62']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6478ee45-103c-444c-838b-5e1bff393356", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.190.156.70']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aa33373-7f86-4a79-b979-f95f2aa3c470", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.200']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1d8a0a4-aaa2-410d-8c4f-741f6dc55a41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0595538-eb9f-4d8e-9569-6cbede85b3e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.167.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b49af48-c7a1-4a8d-ba90-dd4d9b7d27ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.168.36']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be0e8106-28f0-4498-9fcc-4a5263058768", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.45.12.136']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eed0a1f2-bdde-44fc-8cc2-f522df06ff2c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.6.194.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7851604a-52b7-44df-bb59-8c10d7ef1023", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '9.234.8.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5fa4fbf-02b5-4267-988f-ac7aa74a80f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.148.190.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c7e04ae-cbb6-4d9e-89d4-6308ba94103f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e69379a3-5062-4b8c-a743-5e83fb8a0d01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.46']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84aa2bd9-3f3b-4ce0-8f9c-3c6c0f6ba495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f157092-f681-4f0f-a21b-92a2656bb272", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.193.232.148']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1212e650-2c69-467d-aa79-f986515c6dbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.193.232.163']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c988b74-05b9-4129-95d7-6fc7b34b646a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.193.232.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efa7b94e-16f0-483e-9353-2274b5e7f188", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcf00398-bd47-4c42-85f4-ab355413025e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.114']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--293b6e44-6cb3-4260-b5aa-b2550fc0a5b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57fb820b-874a-4939-b7f3-8e04cca07d99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29b9a863-3bd3-4bc5-9b0b-0c5f5b078d24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1acca414-cb2d-49e3-a745-919876a195a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a37c114b-f0f5-449a-bf71-90aad6dcf360", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c9fd915-a79f-41a6-99dd-91e39789bf5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28cebb79-0f36-4d64-958e-1e888393a0c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.181']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7594674-874f-434d-854e-0c149197102c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ff872d2-8aec-4663-8ff8-d1bf1bcd53c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f22bea01-d282-4bda-9434-8ddca508b380", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8b0a0ab-0e43-46c1-aca2-dd91a5730d3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--501d6e6e-7f3d-4220-b07e-b2fd3cccb87c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0659d66f-7642-46df-9218-a741998f537b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0e9c368-152c-400e-85c7-549e3a0669dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fccfdb8-5a61-4293-a5eb-7213e9535ce7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20ce58f5-a239-4da6-83e5-394c325c0aac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80ab61b2-061b-4da0-828c-610c04bf4443", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.217']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6b40bc4-9b03-49b5-a54e-ad0a0c206fc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.219']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6212722a-bd67-4b9d-bc55-4dcf53af9b42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.221']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccbf53e5-b5ba-4b1f-b0fc-ec0dd279e385", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.223']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b8b2e66-013f-4684-8311-57e95e7c7de9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.33']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38f9b123-cb9a-4543-87f1-4c597a5d2074", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.35']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f115111f-e02e-4c46-8db6-87d064a6390b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.37']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8ab2973-e626-4238-a7ce-4bbe107f9888", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.39']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93e85e2b-cdb4-4417-8903-dd0fb6e2474c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.90']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c153e797-db5d-43e7-a1b3-4cf0077739bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.98']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6393344b-0fb5-45ff-a5a2-f357c796af47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.199.163.52']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--417b2908-50fe-4acd-8b9a-08b95023cbbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.205.131.255']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20101229-d536-4a6a-b41c-8345b474babf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.208.197.64']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44830f51-1c9c-45e5-9f22-f18c550ece33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.224.92.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02e1935d-f4ea-413c-b32f-b19d8b2dd247", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.224.92.32']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbb35304-e9b1-4c37-9993-025037f104a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.227.114.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bb8cfde-df03-495c-8165-cf1b1d7e4478", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51c1a183-7376-46e5-9b9c-797c81a06ebe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cf3d3b6-87bd-407e-b374-b9a9fb724f06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.121']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef8f4459-bfa9-45b8-8594-b7d90360d2a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.123']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f032b57e-6e18-4b42-a4ed-5dc0ae518317", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.125']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e83e32e-0887-42aa-be47-27a5434b91d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.127']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90a4a2c8-b206-42f0-b254-4e31b59c99d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74024221-350b-4da5-be2f-fb3beac2a421", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ebc36f5-c6bc-4053-83a1-a073b5d00e29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b6312ae-07cf-48ee-bd92-a28080edac99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d263e86-eae8-4974-93fd-3d9e7bcb92e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.134']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc2cf030-62e0-430e-b091-340887f80746", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8c070b4-2320-4e46-b7d3-52a9a0219e29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2dc540b-3e0a-4c33-acac-e2699d176445", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6478400-a27d-4e51-a6eb-c0fbc8bd5d89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d635f8a-ea9a-4300-86b3-a9acfdb56896", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e56c792f-67eb-4f9e-85ce-0bd4e5e215db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.146']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1d23492-01a2-4db1-9ee4-e9040d0bee51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a1cc0e9-8984-4ff4-b97d-d7db66a501a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43c80748-2ff5-4a3e-be3b-dd5c11875226", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.170']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de5e5e9-427e-4925-836a-6d7725715dd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df22156e-aced-48f7-be6b-de72a7a253eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.185']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36199cd1-29f7-47b4-aff9-050bf45ce82b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.187']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d413a39-e7b4-4bdc-9813-35a1658327b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.189']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5190f37-ea32-44c5-b6a4-465bcac7c641", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.19']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16a26174-1269-4fc0-9d97-4b667950aaa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.191']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ab54bc1-656e-4efa-8688-34bf51c4ef82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adfe5c29-b0c1-48d9-955e-222ef18f717f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da035ee4-f71c-4c82-8085-85e119846f7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09445c7e-df6d-453c-873b-db7c245a88bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37ac1654-e581-4bdf-b2ca-0e9b3bf26fc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--686b12a7-37cd-4a32-9b91-bc65c5f74894", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.23']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7460fecf-dd47-4777-a859-5d5536468238", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d1d17bb-09d0-4d13-96b4-90c932afe611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--150bdf3c-9d06-442b-ad03-55d1b318a278", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c0ce804-5453-4710-89f0-4db4410be8b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc7f0157-0b77-493d-b80b-c471a68f647f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e9890dc-35f0-4779-adab-7bc4958dbb54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.25']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec2523a6-30a9-4d9d-8418-649e2f1ea0fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd6c6007-36d3-4a01-90b1-cb6e0509d40b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eb811bd-ada0-4f0f-b44c-75cf8c8700f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.255']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fac40d23-0a2c-40bc-8c8a-096d330b8f26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.27']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee19bcbf-8808-482c-8dab-edfe063e7d66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.29']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cf5db8b-1377-4b26-8601-3dbc6a48f53d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89684384-cdcd-4c45-a956-0e13eeecb401", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.31']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e372eea4-d44f-4a55-acec-5eadc980a850", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.34']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac7a9bf9-ed8b-4edd-a744-0a03813c571b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3560fccc-6feb-47db-a650-fac26e4787ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62e52318-383f-4ce6-9ce1-6db7d324ecde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be83e774-8454-4f4f-9b87-57db2ec87e7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.89']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04fd9360-5713-4f51-ae5d-ab112d33cdc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb549fdb-3bfc-4057-aa48-415fd5617606", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.91']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4544f11-18f6-430b-b5fa-e92499494726", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.93']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--274a8419-fff6-4093-9d1a-c8e91b7891f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.95']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c75a939f-c6a2-44df-b939-1388f1f5e780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.1']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd49b006-c6c6-4d14-ab40-032c795b08c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.105']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--030873f4-d71a-48d4-acee-09d8cdb0cbef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.107']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9d4e667-a208-4ce8-bcf7-6998dea54dc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c34c4141-8b94-4771-b793-9bdbcb1a9c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.11']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44d5de22-ef73-46e9-a9e6-1a43e1d06668", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.110']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4cdf3d3-0891-44fb-a00c-8cfa271bf313", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.111']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0733edc-fed1-4da5-b4b9-157f07e2aa62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.113']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c0a75a9-9e6f-402d-af23-cbc046dedf13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.115']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af7d27b1-cbc0-4d54-b5c4-8b8b4365f780", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.116']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de755c6a-4a2e-40b5-8635-8a70d82a98ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.117']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64647802-75b5-4ea5-87e9-87bc3c77dbf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.119']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b228213-4e89-4f9f-b945-59949bbfad7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.129']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd90c78d-466b-4974-8e97-6812a3bd4a32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.13']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16660ad7-d802-4454-9cde-b209fbfaa877", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c28880b7-1c2a-41b7-8e82-b4864df1199e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.133']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a21fdd9a-17cf-4088-961e-65bc35f0b5c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.135']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e0a3b07-7ccc-4c82-9331-1530709c460d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.137']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed9bd39b-0ea3-4f06-ab2e-2f68752e0864", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.139']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88ce5a3c-10e9-4706-ad47-0cff511a9bed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.141']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bd9622b-a4b6-489c-ae75-4ec64cd36f78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.143']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--040aa470-72c9-4124-bf98-f8515535c319", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.145']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9459397b-8581-4ce8-9368-e3f5d320153f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.147']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99e9d6fd-712d-46ee-a246-6d1350ea1018", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.149']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4f84721-ca1d-471f-a24c-ab298c679718", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.15']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c644abd-60f2-41fb-9db2-4f733af8ac32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.151']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a85b0a9-5bb0-4159-ab11-1dde72f64b29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.153']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c179c35-df1b-4e87-bfc8-9676c75caeeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.155']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b13d68a9-21bf-4d05-84a0-44e0272ffd94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.157']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41180880-518e-4220-bf86-978dd155ca76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.159']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e53a479-0fe8-435f-a2f2-181531e5a54a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.169']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b80f657-a8ad-4903-8d46-a9dba072eac0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.171']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afad71a7-0417-4daa-84be-8c17625c2955", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.173']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51798ab7-c921-4765-a839-a71ec85dbc05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.175']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42d95c04-c863-4f23-944d-6b3b6403e237", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.178']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6922398c-5f57-4f0f-9fb8-de217ceac478", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.194']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22e84357-4eb0-4c42-ba4d-46fa56b0e6d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.201']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0aa7d2f4-d2c8-4346-b8dd-13f51b2ac4af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.203']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd917e69-69bc-4143-9e41-c1b4e9b822ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd42ab36-eeec-4c31-8ae8-72ae2ffdbaae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.207']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63bdd883-5fb1-4dcb-a1df-29028d1e8a70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.209']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8500bbeb-21a9-4212-9081-32687a1e322c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.211']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5b53fa8-eb5d-4a41-ad96-c1550f0409f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb424fb5-8f92-4c02-8e9c-7dda1c2bee67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.215']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca049751-8039-4f96-b075-38e235e1d5f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.218']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24a2f9dc-c863-4fcc-908e-5549ae00cf7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.225']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--961e6f7a-eac4-4d15-80ec-899fe8c265b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.227']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--282ffa02-e470-43bb-9305-557db3e39559", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.229']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3cea376-7135-460e-afb1-5c13a1012942", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.231']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4acd9cc7-35ca-41af-b560-bc8197250bbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41788524-8e4b-4462-8442-2d8991e334a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.235']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64547b6b-2c89-486e-bf85-41b8a1e46aba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.237']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46c709c9-8cdc-434f-861b-7a934c311c25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.239']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12626c78-2a25-4e92-b29b-1cba5537df64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.241']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--630ecfff-cc15-4310-86cd-f16727d57fb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e198b269-a9d8-4c2e-ab29-9a8811fe14bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14803a77-5589-4870-9c0a-94627e8031d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.247']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64075f62-a931-45d5-ad7c-c4c347a26dfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.249']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4480733-c436-4d3c-b4ab-367298766dc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.251']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e89250d-a263-4f4f-9ba0-102db8e2ca7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.253']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbf4ed77-cf63-464d-9fdb-3de7136df404", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.255']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bcd38a8-888d-4d63-85ec-c71bd91a37bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.3']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f52057c3-30ad-4fbb-8596-bc29e4dd2891", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.42']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02467ca4-2806-4586-90f1-425a905b39af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4350bb2-13a7-4d69-ae57-c4906eeff0ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.65']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--607806ab-c080-41e7-b793-40bce4ced114", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.67']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf510093-a1a9-4d26-8e5b-ac0a0c86fd4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.69']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--945e660f-0332-4005-a753-fa9e2d13ce46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.7']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab47ee10-6dea-4184-926d-9b4aebcc1b2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.71']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9913180-fbe6-4fea-b342-f852548d1219", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.73']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--630d9bba-a80e-4375-8e9b-b47c3a5f67c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.75']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52b390ce-23ef-4054-8654-b1b7e4c5ba69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c588f3bd-bb29-48ca-964d-aaeb2c5ffe50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.79']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd18669-6e84-4788-8467-d1b355aac4ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.81']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4adf4626-7a5c-44bb-8c06-f2f74e9797d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.83']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6af6165c-0136-4de7-a722-693b1729f9cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.84']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--882c6231-7b17-4d61-a838-c59f43b568a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b17c1743-e019-47e6-a6e1-76ff07517cbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.87']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5dfda0c-0bb8-4671-bdc1-e98c47b65a94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.9']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87bcbcef-7150-4797-b49e-8615fdba7dec", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.80.152.183']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9916acc8-cd3a-4b34-b5f7-e35ddfa45913", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.42.243']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73dc2b49-ad20-4993-8c7e-bc7151edeeed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.42.88']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdfbbb5e-685f-40e7-924a-84ec3e924f84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.98.151.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca37794f-f350-44aa-8dea-e3cfefd4dd7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.98.80.4']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55f2914e-5d5f-4d7a-a37f-3d94b63c2798", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.236']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--091f37f5-bbfd-422c-b3d3-ab38beffaca3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.74']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--915b4527-d852-424c-b903-d7dc69218ad9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.5']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d84dc799-bbf8-440b-b229-72c699f01280", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.164']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0661ea24-7ae9-4036-bb4a-adb39ad014ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea77a003-3130-4b47-87fb-e00dca12d695", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.167']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83564cd8-acba-4d75-a810-8518d1cadbfb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.72.166']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5981f98e-dd8a-4923-8d79-70db95740df8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.159.230.85']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e26d046-d7db-4e5a-9fc6-0deae8e2fce5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.93.12']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b40ac746-37ed-47cb-bbaa-2ada4dd83111", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.95.106']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fd8c953-7b0d-437c-8344-1b3c62d6d2ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.234.151.21']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--904ce209-81e0-4ffc-a614-03ab53b7d4d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.102.49.193']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82a191f7-4d6a-4a0d-b0f8-ef972b0fa7bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.131.239.17']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdbae1ba-699d-4431-87a6-f2bd29a58da5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.156.115.179']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0a7045c-35c8-4311-a5d8-eba1f6bb142a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.183.235.102']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84d04d58-8418-41fe-9cce-8eef4d2f85ff", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.183.31.168']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fa64bb9-aaef-4c17-8d7b-451e6c35aa58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.183.84.109']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f653cf3-5aec-4e11-a3f6-28a14484391e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.10']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3170f6c6-c115-4b05-8f6d-a3d1f1d20f44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.128']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1888d3d-cf2e-4c82-940f-f52a1fc634e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.130']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e816394-fee5-455d-bc6b-35bf2c1bf90d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.250']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d5b37bf-df9c-473a-b228-9c3460bf2e6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.254']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51b67849-3333-4d36-a4d2-024bfae018ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.26.68.54']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0cbf0b1-8e44-40b3-b1df-0f6fe34e0ace", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.66.133.63']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e30904ff-fd98-40cb-a57e-d976e6bb17ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.128.190.248']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db303a58-3ab9-4384-96ee-ff72195806e1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.155.37.205']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58bb8006-fdec-4e8e-a102-f3605de35abf", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.167.53.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72c3846d-f673-4b12-a704-f17792caa0e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.179.132.186']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91e2ed9d-7aaf-4f96-816e-30490619892e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.182.82.132']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c85c8f1-9225-4ce2-bcc9-c368ff8bd29c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.214.52.233']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f2e8ae7-e82a-4b24-8862-13b4fd5d48ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.214.55.77']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6310092-3dbf-4491-a1cf-fe550d061c3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.215.108.177']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--700f92b9-8b42-473e-8f74-b97efd309f03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.215.108.8']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9c8b01c-76d5-4fc5-8c2b-130a5b3b82ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.31.104.78']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34d60425-fcff-42c6-b6f8-e7d89dda78a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.87.231.131']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e4ae9ba-3512-4c58-910d-f059f03e8ca1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.127.153.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba2e1b4-acf8-4116-b518-540c537a210b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.127.175.154']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e1d6fde-1b5c-4ffc-b71b-88098bfa33f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.133.213']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--942fee6c-59ea-41f5-9012-1bc9f0626964", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.141.150']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8a32372-ae49-404d-a458-cc5d14e7d76f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.81.154.174']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--860c1289-6329-43c8-aed3-dede7147f2d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.89.204.118']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f4b6416-09ec-4d44-bbfc-e549fde5e301", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.90.43.197']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4b93b23-89af-4b41-a23e-31721e2f34d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.94.39.245']", "pattern_type": "stix", "valid_from": "2026-05-28T00:00:00.000Z", "valid_until": "2026-06-27T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-28-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--146ca359-8147-45e7-93e5-9224ad3c532c", "sighting_of_ref": "indicator--8ee40e51-5906-45f1-acaa-1535a4e37a6f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c52943c-54d1-4810-946c-6349ec2a0fa8", "sighting_of_ref": "indicator--e1261778-9a23-448f-b0ee-28807740e9b8", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b31bb7f3-bbd5-4f50-b3d1-9f9c86d949c4", "sighting_of_ref": "indicator--2d24ea3e-1354-4df2-9218-aa058dd63bcf", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b20443f0-4ece-4bf8-893f-8750fe5dd3bf", "sighting_of_ref": "indicator--ee048713-e742-484e-a34e-c084c828536e", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97f8695a-37d8-4779-b700-9f5fe2a000a3", "sighting_of_ref": "indicator--5664bdad-e95e-466d-a6b9-797eac6452a9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8168cd0-a8f3-4f21-997a-4a3ee6fc443c", "sighting_of_ref": "indicator--a2390710-dbcd-470b-82f4-b67fa14a11f9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f5b4eb1-21d4-4eb6-9cb9-0412ec622879", "sighting_of_ref": "indicator--193f4ad1-b0b2-446a-b391-2cb44dd5c1c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ad185f8-47c0-4880-b3bc-c63ed2877f33", "sighting_of_ref": "indicator--f382ab08-87fc-4b70-b90f-21f01483fe35", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd1eb8a3-de1d-4606-ba0d-7f911559767b", "sighting_of_ref": "indicator--21036317-7ff7-447a-97b2-79f99cebcc4f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5be46868-c81c-45d7-8c17-23ac5b250b69", "sighting_of_ref": "indicator--e0650c81-d7ee-4a73-905c-dc1aebc8c96a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e71b06c2-c922-4eea-bc00-3c614e4b319f", "sighting_of_ref": "indicator--c33579ea-c461-45d0-8e91-bd601ea752ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fddc6442-9d89-48a6-812d-45274114ace2", "sighting_of_ref": "indicator--b57f58c1-56fd-408d-92d4-56c8d437c7a6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3945eb-ee61-4567-9072-284537fde70f", "sighting_of_ref": "indicator--ec814fd2-b1b3-49f5-a124-b72047bf20ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ea4cc3a-62c6-4700-b90d-2dfca9b48707", "sighting_of_ref": "indicator--e1031af0-3da2-4069-b801-a9214ebd850a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e214fb4f-971b-4134-9955-f1eb42202b03", "sighting_of_ref": "indicator--ec23214c-539e-45a0-8d03-1348259904a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--570caca4-8125-432c-abd6-64ef6cfcc575", "sighting_of_ref": "indicator--c049cfeb-c7d7-4356-83ba-43c90113bf54", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--804fce1e-237d-43b4-a01d-8995f8098dcf", "sighting_of_ref": "indicator--d40de5da-22b2-4344-a2aa-bed5025c993a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b47edd0d-00b4-41ad-910b-32913cf92383", "sighting_of_ref": "indicator--5ad2d517-835c-4ff0-ab7a-c4909a1c5c66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5ee56cd-df27-4f74-911b-16078eb786a0", "sighting_of_ref": "indicator--37a6355b-035b-4d27-8c39-e255643ed96d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c30576c-af64-4e6f-81c5-b0ddbcb03c54", "sighting_of_ref": "indicator--097958e8-91cd-4a54-b0fa-df9e06cb190a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c08da75b-6f01-43e4-8924-c4f5be77466b", "sighting_of_ref": "indicator--278883d2-308b-4845-927f-f8ec50345229", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8a95635-5a8c-48ed-8dfb-707411ffe7fe", "sighting_of_ref": "indicator--528312aa-50fd-4ef6-9d0f-9de0c268442a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93e82614-0cf2-44e5-afc3-41a285f79e01", "sighting_of_ref": "indicator--672549c8-c2b0-4775-b322-85a78b20a4ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b48be630-6945-478e-b501-36b061978500", "sighting_of_ref": "indicator--ba8a318a-2a54-4984-8dc1-cd4144732719", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8fe5b10-6567-4790-bb75-87a80dc068af", "sighting_of_ref": "indicator--46767c48-d7c6-4086-88e4-deb8ee530058", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bb7aa10-03eb-4aa7-b05b-20b510cb9719", "sighting_of_ref": "indicator--a5628a5d-f7e9-43c4-818d-696a2a002206", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7af4b78e-1f33-40bc-b797-1f54baea3c38", "sighting_of_ref": "indicator--5d52040f-21ae-4189-a0a5-1ab6c8f76b70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e9897c4-c740-4c6f-96ac-553c6c12a2b4", "sighting_of_ref": "indicator--f25dd2b0-a8d8-40e9-b2f3-3aea4553f11e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60452bf5-9c7b-4a1e-b010-eb1ffc92c345", "sighting_of_ref": "indicator--0acff69a-57c4-4371-aeb6-9af8949b04e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ec787ae-6d84-404b-884f-f945e8cbe67c", "sighting_of_ref": "indicator--24f0f1a5-ffc7-4037-a154-4599a33f03ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90cf715c-5ad2-4c2a-affa-2e04641bcde1", "sighting_of_ref": "indicator--b50144e6-e51b-43fb-8f22-0498397a52e0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba4ec54e-02aa-42e9-bc9f-e9647c55dc06", "sighting_of_ref": "indicator--677b3940-aeda-4c30-ba7f-2f0c070991c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db23fb7c-c2d7-4380-b742-f6d26412a629", "sighting_of_ref": "indicator--d1dc0c30-8ce9-46eb-9213-fd03e9ad1665", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53a143ab-be08-4c7d-ae1c-f5cc82b68456", "sighting_of_ref": "indicator--75b11aa5-ed0a-469c-8c7d-bdd96cd61a73", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03b00bd0-c3a4-4cdd-891e-cb132abff9f8", "sighting_of_ref": "indicator--b8e1792c-e56b-4e30-8347-51fece593ab0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0bfdc18-3b08-452c-9fc1-4e9717fe19c5", "sighting_of_ref": "indicator--0f05f670-2a41-431b-914f-91ba8822807c", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1f67309-c36b-4bc6-b0c0-8495aa3ed32c", "sighting_of_ref": "indicator--4b8f7956-d618-4262-928e-f7a5899f8246", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c6520d3-4a29-4efd-927f-95c974199f72", "sighting_of_ref": "indicator--04dab19f-5648-4bde-bffa-d508237c09bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef08e9d-20d5-4df4-be2e-0d2d7b980eb8", "sighting_of_ref": "indicator--6a7559ce-c8ff-41b4-8bed-f317ab475385", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e74142da-f41b-4b93-8b0f-0fc6def59bf9", "sighting_of_ref": "indicator--a720b153-e761-49de-9ce9-04b118e32094", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--debe9fb0-7133-413c-aa00-302ee19c9bdd", "sighting_of_ref": "indicator--fcf7eaea-92e8-4c5b-942a-1fe70b69c3c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c05982cf-2a92-4ce6-a419-248ee0fdced2", "sighting_of_ref": "indicator--db365646-a426-4d67-888c-91f4ac1d3dc9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--727187e9-f803-4e79-a5e8-9291e3473db5", "sighting_of_ref": "indicator--1bb35cc9-9b4c-40bb-8401-5499480e1687", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ec8af4d-31fa-4a8c-af9d-d88fe5e0f179", "sighting_of_ref": "indicator--d91f1f5d-9924-4381-baa7-83e3ebc89cda", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b2f5319-beae-4602-8442-ee6fee7712b9", "sighting_of_ref": "indicator--dd3ff821-ed4e-4ef1-9329-6b898bf204e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2033e2a7-77ed-463f-8cc5-6969b5679450", "sighting_of_ref": "indicator--e5ad7c2d-d7d9-49e6-a910-8ec54812ad75", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--006b9f83-c888-481b-a9ec-3e4a14f789b4", "sighting_of_ref": "indicator--9726814a-7f6d-48dc-affc-85b6aea240a6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c1b1a53-6785-418a-97c3-8dd10c3be453", "sighting_of_ref": "indicator--2a59d73e-b808-43cc-abff-67d9ffdc7287", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12ab0b53-5d58-458a-9b1e-1bb0b0b3ce4c", "sighting_of_ref": "indicator--d796c7b6-a3ff-48bf-b5a4-e804dc254f9a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--794114d8-798c-4349-b74c-3110d4eea2b5", "sighting_of_ref": "indicator--0c337d1f-c024-4eff-94c5-4f166c9d8fae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbeb20d0-ca84-41c1-80de-efa3856323d3", "sighting_of_ref": "indicator--a6eb1358-96f9-483d-b797-a8fe8476971e", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f68ced4e-ed15-405d-bcf1-8c4ec8675edd", "sighting_of_ref": "indicator--de3ded42-db36-460e-8756-804406fcda73", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5de62fd7-3301-445c-9cf9-7cc6e4ae1dad", "sighting_of_ref": "indicator--7195345f-b7c0-44bb-9fe6-232075a95f2d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da9d2f68-dc65-4afe-b41e-bbe75a8fd750", "sighting_of_ref": "indicator--d457171b-ef08-4160-aeae-11aa77a0c9de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6c75742-8385-4481-9675-79c689d75ac8", "sighting_of_ref": "indicator--e2265a20-07e8-4ba4-94ec-014a16bcfc1d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d582d80f-40cf-4924-8a47-232b07679e5c", "sighting_of_ref": "indicator--0e48f9ea-9d92-4513-bf65-e9d66b52219f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d58270a-4248-40bb-9d96-c482e62e81ef", "sighting_of_ref": "indicator--74168bee-79c4-4629-9ce0-3ad54937c07e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c31d7ad-a462-486c-871f-b03a6eeefd8f", "sighting_of_ref": "indicator--45862e54-1cd1-43c0-b307-409f7d3db9e0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eb379ed-86d6-4af4-9980-9307cf05ce4c", "sighting_of_ref": "indicator--29df5862-245a-4b7f-ba21-254743c7fc5a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fea8e93-8708-4446-9160-9d6f7172ccda", "sighting_of_ref": "indicator--603864b3-9f25-4c56-9eb9-2bda0026e506", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--426c38d0-e6e2-4f10-b199-574f555a6e63", "sighting_of_ref": "indicator--2ca71785-07fb-486f-91cf-e3019d817eac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12f62ae6-1d80-45df-9a68-b7caa7693452", "sighting_of_ref": "indicator--35ebb346-81d6-48b9-b91b-445124be69cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d10c68a4-83c7-4089-9f3c-e88e58e2fbaf", "sighting_of_ref": "indicator--1d2ceca2-2f1c-4cb7-afd9-046224386d99", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1746b383-2aa4-45b5-af0c-be19bef46eca", "sighting_of_ref": "indicator--7d2ff2c9-c151-4bae-aba9-ac3c3b0c3c3e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6299958e-9714-4f5d-bb37-c1bbc0b589d2", "sighting_of_ref": "indicator--fd6dd728-e1eb-4ff5-8fab-39cd01d537f0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--468cff1e-f805-41c4-8c1d-ce92cb43cf2c", "sighting_of_ref": "indicator--59b08f60-81ce-407d-ac2d-3a240587b24a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e53f6c99-7d53-484c-b9a1-93733ba8ea35", "sighting_of_ref": "indicator--f6796760-0968-4494-bf26-e84a965b2001", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ead2ca13-8c2e-449e-95d8-8ca7b3e29aa7", "sighting_of_ref": "indicator--500ecc25-d6cb-4113-b4b5-8a03a3228d92", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5887d1bd-443f-46aa-9e16-474cc9bab2bc", "sighting_of_ref": "indicator--3cdd3f18-872c-4c4d-b0e4-847aca92864c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0a57788-a12f-46bb-881e-5e608c508270", "sighting_of_ref": "indicator--85d7077a-8464-4a1e-9ea8-becf396ebd89", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec7aa7b9-3395-4844-9062-2aeca7892b59", "sighting_of_ref": "indicator--ef866073-c68e-4c82-bede-91d34013c693", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30225082-de46-4f8c-828c-a1e97f52d722", "sighting_of_ref": "indicator--ad1ea469-4a83-408d-994a-88e5bee32d9c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2cfb83b-e302-46cc-8685-50b9db7903af", "sighting_of_ref": "indicator--aa8d0de9-81a2-41a2-86a2-26a957ccc0d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4d84c6a-98de-463f-bec8-96028f8b0f2c", "sighting_of_ref": "indicator--e4d79be9-1544-4c3f-b332-8f9461e545d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b5ed19-3c9a-430b-a8ff-5fd0c79b719c", "sighting_of_ref": "indicator--b4d72b36-4a02-4fca-bcd1-1fe1d6afde73", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b018f252-3609-4fd7-a711-3f59848805dc", "sighting_of_ref": "indicator--54f9e3be-678a-4707-bee5-b607476720f8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20e01152-6bad-4633-84ff-f9403e147d75", "sighting_of_ref": "indicator--01cb0519-be61-42cd-9671-7c206782ce89", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2d8a104-21a8-41e1-bdd9-afd24469b229", "sighting_of_ref": "indicator--6d97bb7a-2a20-481f-912c-1293aae236cb", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b11489c1-9e69-4674-acb7-4c8408e54e96", "sighting_of_ref": "indicator--a57dad7a-8643-496a-803a-c00045f0fed9", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d32c9e-916b-440a-8f9d-fb9ecbf7fa56", "sighting_of_ref": "indicator--712fb0cb-b3ce-478c-8d20-8a3b0c568aa1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89994c7d-a0c3-4c15-8955-62b1c6d74b2c", "sighting_of_ref": "indicator--63adc6a9-06be-482a-bb16-5b5358132039", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f689203d-f7cc-4b77-b874-dbacae72c57f", "sighting_of_ref": "indicator--48e78047-a664-4b03-a34c-a531e90f9125", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e2fa871-cfed-4898-a013-0e92b6c25640", "sighting_of_ref": "indicator--9427b744-5c11-4014-8986-5de4bce3ddde", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dbf4c65-91c5-48f1-bb41-0d4994a60e4e", "sighting_of_ref": "indicator--d6e5dc71-c6db-41fe-b241-14b3256f5884", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6b6afa0-e062-451c-9f0f-62b13a95fa7b", "sighting_of_ref": "indicator--2dbaaab4-0e13-4b7b-af5e-57f181c90217", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb91ee5b-10f4-40bd-8b77-47a59472dea9", "sighting_of_ref": "indicator--7ccf1ed0-564a-4a4f-8a65-3d4a644610bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a75a47ba-adbd-4b18-8e3f-aac391bfd22f", "sighting_of_ref": "indicator--2b0b534e-c07d-4c7a-972a-1cf29759af18", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--673c0170-abf4-4957-8e6b-2dc548b0dd3d", "sighting_of_ref": "indicator--6570fc76-14dd-4c16-bc53-da77c6ebb0af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9e70355-4917-4eaa-a420-f327a1a61940", "sighting_of_ref": "indicator--22f3ed35-d004-4c03-a431-db941864c1ee", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df3e8d00-b44d-4e9c-93db-bd5e5f3ebfd1", "sighting_of_ref": "indicator--18d991f4-6ebd-47b8-9f4f-82efd9ed1bdc", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99b5588f-0f93-453b-8119-397a412f0023", "sighting_of_ref": "indicator--e75ecf18-7bcc-48d6-b55c-f018c4761961", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87a70bfb-eb48-466e-9c05-890e3579db5e", "sighting_of_ref": "indicator--238b2efa-5067-4583-9036-13e3ed1f318e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ceb6548-92fa-4a8d-9c5b-2c28ba11f60e", "sighting_of_ref": "indicator--ac90744c-692c-420c-a6a1-d91b56cc61fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8aa8453-c7c2-47a7-bc9e-0befd094d0d7", "sighting_of_ref": "indicator--4c49a58c-ee97-4776-9303-aaa84daecd3c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e0325db-f36e-4252-ac0c-4e0dff9b06a5", "sighting_of_ref": "indicator--db040c63-0d14-4b5c-b0be-e243674ba002", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f94e4fa5-0ccd-4d65-9a90-8a19cc078260", "sighting_of_ref": "indicator--f7f9b171-3bc8-4122-baa2-56abced5c378", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd0181f1-16e1-4236-a380-98aab4a5a394", "sighting_of_ref": "indicator--ebb1ddf3-3f04-4204-aa00-d9a32c01b951", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93421876-15d7-42e1-abf8-cde8b3536677", "sighting_of_ref": "indicator--dc3f482c-cd93-4f73-adc5-0df782b393e8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af00a5ef-fef9-458b-8772-7f81b10ba619", "sighting_of_ref": "indicator--032e2c13-72d6-4690-a441-9b7a7f5d6860", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--463f7a65-65c7-41b5-acf0-1cd6572c77d7", "sighting_of_ref": "indicator--0c098317-bab7-46e4-a825-ace43b89d944", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e81f1d4-d4e4-4995-a11f-48293c8e9f29", "sighting_of_ref": "indicator--a7df88d1-c305-42f8-818a-42a2728b170e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513e747b-83f3-4c6f-af7c-ddb223d1068f", "sighting_of_ref": "indicator--3a7ce29f-dea5-4dfb-b553-3bf74e9cec41", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1379778f-cbd0-4c88-99d1-d7c8662c7f6c", "sighting_of_ref": "indicator--d1b74821-8e88-4c43-9c1d-a88e7b639026", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--492582a4-9b1a-40fe-88c7-56bf6267ea03", "sighting_of_ref": "indicator--d262ec3f-33c9-442f-8139-97c4ad93d748", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9faf3c75-8add-4d3a-873b-476f4b1e5f1b", "sighting_of_ref": "indicator--ae5c380e-a580-4968-96f1-3a71fbd1d12c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e2404a6-dead-4529-be9d-638730ef6e66", "sighting_of_ref": "indicator--9b1cc9f6-b172-4169-8d60-361622851ceb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88782a71-cd7e-4a42-b523-59739492a981", "sighting_of_ref": "indicator--114ddc48-8a9e-4604-8292-9d4c0eb09806", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--507e9bbb-1135-4591-8440-5f504dfb85fc", "sighting_of_ref": "indicator--d44e6921-16a9-49e7-be08-a6597c93dfec", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2c7b7f2-2f4f-4f2e-a7d6-65ae83673b75", "sighting_of_ref": "indicator--9e2cd45d-a3bc-4451-893d-dcedef76dcb4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b13f470b-9c67-462e-ab39-63e093abd727", "sighting_of_ref": "indicator--6eb9ab67-cd86-4d00-98b4-6d6a4b5b19c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6519bb57-3e6f-4e9a-a08a-3047b0777588", "sighting_of_ref": "indicator--a2e96d4b-250e-4e34-b0d8-016cedefc294", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfc22d7c-e7f5-4bca-a2aa-f2adb712ef26", "sighting_of_ref": "indicator--95124f78-e3c1-4eb6-b22c-5f0b4a19b5b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--186e464c-f268-45c8-8a08-1eacf675a033", "sighting_of_ref": "indicator--ef81aaf6-abbe-495e-baba-081543ecdde0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--173c05d3-a34d-4a2e-ba75-15f2a2f0d473", "sighting_of_ref": "indicator--c1daff2c-244f-40da-940b-f172d22d85d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--336749f0-0a0f-436b-92a6-f7d309a096f9", "sighting_of_ref": "indicator--5565cb70-071e-4760-a43f-dca8a8f013ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3ae7a98-89df-4e5e-9154-c42b625d4e16", "sighting_of_ref": "indicator--6d622722-9dee-437a-af2d-e74dc27a21bb", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d1bbd45-0de1-476a-aede-b60e487a331b", "sighting_of_ref": "indicator--7a96799a-f90e-491b-b12d-fb74aeb8b19d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f728274e-affe-43f2-83f2-60dd97f86d55", "sighting_of_ref": "indicator--d5113825-544b-4333-80d0-a53efcc04b8b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3234278a-a3fc-4de8-a06a-c06b1a8190ef", "sighting_of_ref": "indicator--d07d1b0a-74e2-49aa-b630-c1e5e036dd3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa84ff43-9352-45d8-9879-3da7f22d5a73", "sighting_of_ref": "indicator--df757268-c07a-46fa-9fe8-b829c532131b", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f780958-9776-4d8d-9fcb-b031be7e1ac8", "sighting_of_ref": "indicator--2b2cd447-ba62-4ae0-9420-6fe72d90164f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--296fc473-dd28-45c8-8e88-48a1b6588cc8", "sighting_of_ref": "indicator--2709dcf8-cadc-4475-9cfa-eb3cbe015a59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aad5935-8d20-4f0b-ba09-8a269e68570c", "sighting_of_ref": "indicator--053bc98a-8f06-45b1-8ec5-cb90f624c06d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd5ece3a-3d53-4ae3-b167-d8f49ed2087d", "sighting_of_ref": "indicator--ed585508-6fd6-438c-a230-28736fdda256", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14d0b82a-b2e5-445b-87c7-94d1cf69ea3d", "sighting_of_ref": "indicator--c3752fee-43ee-46ef-8ac8-ccaebd351032", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fd6400f-354e-41aa-aac9-c6a7083d9c9f", "sighting_of_ref": "indicator--a5fef665-9bf0-45e0-ba79-3b9805fff2d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c6154e2-0fae-437a-84d6-af3c380c17d1", "sighting_of_ref": "indicator--502f0955-a40d-4fa1-8bc8-adbd7208ea41", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27a4d5f7-9edc-4de1-97f4-0c0b9ef2d4c7", "sighting_of_ref": "indicator--3b8ea982-4e4e-431f-8df8-c1c0c83ed065", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b98ed77-c9a5-4dff-9d7e-8d260fc0e2bb", "sighting_of_ref": "indicator--ea0ab64d-5091-4884-9608-d8005ec1d4d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95556d09-6238-4bd1-bd61-a0f804f3b33b", "sighting_of_ref": "indicator--079e621d-563a-49a9-9368-1d68674d47f9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--533abfd5-848a-458a-b988-4364fec3dfc8", "sighting_of_ref": "indicator--079e621d-563a-49a9-9368-1d68674d47f9", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c18d1ab-c7de-4d31-b957-dc1028623dd8", "sighting_of_ref": "indicator--8ca4fe6a-7515-4855-975c-c7a7e456355e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d31433e-6f1e-4c0d-a0da-88c127870782", "sighting_of_ref": "indicator--f90a058e-49b7-43e8-941a-413305f50157", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6ef2548-acbf-4da3-b124-3c68475af70e", "sighting_of_ref": "indicator--41e71e0f-ee5d-41c0-8802-447ca193ff18", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd75de6b-983c-4358-a906-86934a88c82a", "sighting_of_ref": "indicator--d060301b-e786-40d8-88d6-84bc19541c71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--616679f4-108a-43fc-adc3-3a68a784eed3", "sighting_of_ref": "indicator--4f873054-8580-486d-a83d-694100a9b6ae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee2c5808-a618-4137-b8c4-ee297a703af3", "sighting_of_ref": "indicator--3625c709-9311-4e12-af01-c8a2f4aeff56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25db80a3-631c-4b49-b1aa-aee9ffc37bcc", "sighting_of_ref": "indicator--8d349812-9b97-4495-b8ee-9f60a797a230", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96c929ec-e9c8-410d-880b-a8dd3c612e91", "sighting_of_ref": "indicator--68921cc8-13b1-4a12-bfdb-02b0a9ed4e72", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0822e2df-7750-4606-83ab-13b2824363da", "sighting_of_ref": "indicator--a8ba32dd-66fc-42ec-86d0-676aa9523625", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86c68274-361c-436b-8298-33f4f85e03d7", "sighting_of_ref": "indicator--1b8cbac5-92d6-4d2d-8193-78a2c4f5b96b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--041535f4-bd21-4493-aae5-a0c0fbeb6092", "sighting_of_ref": "indicator--9c594bfb-0380-4324-aa71-ecf65210a9f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68067e44-aff2-4001-882f-020d4e9543eb", "sighting_of_ref": "indicator--df08f148-21bf-48ed-8dab-18d3b792862a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2481797c-4771-4530-94fb-d83447dd8ae4", "sighting_of_ref": "indicator--1d7c5fc7-00dc-4a72-8b57-cf5751bbfa29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163c3dec-4d49-4883-b3bd-92ce08d3f6fe", "sighting_of_ref": "indicator--86d1760b-41ad-403c-8acd-a17d64b3f979", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b2d78dd-0d73-4b53-b574-552710978bda", "sighting_of_ref": "indicator--d0dd2ca0-7555-4262-a15c-ed613613fbe9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--750618e0-e183-459d-a6a6-3ddb28a0138e", "sighting_of_ref": "indicator--322b67bb-f41c-472e-9452-0b6a9643e749", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d68893a5-2f91-48b8-b97c-8a6bbfa8128c", "sighting_of_ref": "indicator--890bddc9-6980-42df-9357-4f75f13e4852", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4687472-ea87-409d-9541-183c63cfa55a", "sighting_of_ref": "indicator--53dc3ace-522e-4d59-94f2-4361850e697d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b85802d3-c04d-47a8-82ce-712f23debde6", "sighting_of_ref": "indicator--cfa66f3f-582d-4e79-b21e-6fa5de57a151", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f86c715b-c5dd-470d-9729-d4f1fd3f4bdd", "sighting_of_ref": "indicator--5831c389-cc63-4235-bdba-b0908984bbfd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ce55521-fea0-41b7-9828-225125bf7b57", "sighting_of_ref": "indicator--8199d353-ac3f-447f-870e-32c845deb509", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c452434-a825-41e1-944f-c4c4f480f429", "sighting_of_ref": "indicator--a7b4b5df-678c-40a8-9d98-3d16d753aa6a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb0deb96-f7a2-4dee-8fbe-48a4b3e529e2", "sighting_of_ref": "indicator--93d45633-d143-4d43-ba5a-4759a76360c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c19b4303-b571-495b-8e2e-ac1943a28cb2", "sighting_of_ref": "indicator--0742fa41-fe70-46d9-bd0f-365b6c30120c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e19ade4-d111-4577-a0a5-4820608c2a61", "sighting_of_ref": "indicator--0d4b0555-8532-4550-b65a-57a3c3559ffb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd529cb5-93a3-4b94-ad9d-2255cfdbde76", "sighting_of_ref": "indicator--479581c2-4808-4b6f-9479-8963820a6816", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e4d161c-be22-405b-b862-db1305354a34", "sighting_of_ref": "indicator--b65d9369-6af9-4921-a7d1-a7129455f356", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f17b166-a024-4d0b-92c3-78e5d4c56ac4", "sighting_of_ref": "indicator--4dca5f67-9128-45ce-bedd-3aace0c9d4b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a97c594e-ddd6-4b56-aa25-313f2c3e94c6", "sighting_of_ref": "indicator--0e6fe064-e0e7-4b84-a3da-3d28f0a2c8f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5987bcd0-2fc4-44b0-850b-16d4eadffd2e", "sighting_of_ref": "indicator--0d139c82-4c0c-4355-89ef-3f579d1bf949", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a2e0d81-9d23-45e8-8c09-649c7e1ee9ca", "sighting_of_ref": "indicator--8595a290-92d8-4c43-a344-f3f5700a2c10", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d673c2a5-c2b8-44f8-9e4e-0a4170af2a5a", "sighting_of_ref": "indicator--22989902-88e9-469e-bc4e-4d6248ad7a70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc394691-09e2-48f5-9c87-3ab8f0a68b25", "sighting_of_ref": "indicator--20d7e9ee-1dd6-4f19-b06f-cb0b7e8a6817", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94164c92-64e0-46dc-9a07-b1edf70a345f", "sighting_of_ref": "indicator--ea71c784-3f52-44b6-ba19-635e65f2942f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa007692-9313-477a-8e4c-0ae91b7542dc", "sighting_of_ref": "indicator--5d59c854-8d30-40c6-8152-99e4a00e417d", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e559d725-c8ff-46c9-a250-2351076e02c7", "sighting_of_ref": "indicator--6f190ea5-a836-4c77-bf42-7f7fa02e3834", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf11e4b2-0e6f-4049-b23a-3578b48915e4", "sighting_of_ref": "indicator--2f188209-9547-43fe-b6ad-3421e77fabd6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4406edc-7089-4d27-a0bd-6084550686e5", "sighting_of_ref": "indicator--ccb5a84f-b084-4d43-884e-3e790cbeeb55", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df0fe1fa-689c-4a83-ae6d-f2def9994f1f", "sighting_of_ref": "indicator--e7590df9-d375-44d1-aba6-58bbb530faae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e0f3a6e-b80f-4c83-b573-4f23c42c1d62", "sighting_of_ref": "indicator--21c7cdd0-51dc-48e3-9d4e-fa101ed76cd7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45707b6d-2362-41ac-91ea-57847a82260e", "sighting_of_ref": "indicator--59fa0e90-4088-42d8-9c56-34850731fd3b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83f44599-9008-40f3-a8e1-b5973a4b25e4", "sighting_of_ref": "indicator--b047d9bf-0b49-4bf1-b375-9aa36f95d295", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dff94679-cf42-46aa-92b8-368365bb0f4e", "sighting_of_ref": "indicator--f6168694-bbf4-4fe1-993d-d6af1fea42bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d612dae3-9057-47bd-b179-7c9e12e92f0a", "sighting_of_ref": "indicator--51bd09ed-5301-44a8-9970-46d246806121", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3ed4a7-1582-4923-87b2-83e564404f81", "sighting_of_ref": "indicator--4d6c1535-6e92-440c-b45c-f55246a2a5ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--957302ee-a107-4b8c-b615-9bf8713f482d", "sighting_of_ref": "indicator--23c4d1e1-7920-4606-bd30-228683de5975", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ae5599d-8343-42f1-a5c0-826ae73eb568", "sighting_of_ref": "indicator--aeec6a97-3bad-40e1-a915-8c906c61576e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4650fe3c-4b4b-434d-a26c-d1da1035b3b4", "sighting_of_ref": "indicator--f7017ed0-191b-4398-9dd8-4e658dec2adf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2eb0ef7-4c81-4ff9-9375-c12b7a23bb17", "sighting_of_ref": "indicator--6a47e766-861f-4e71-b9f8-15368ee2698e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--117b28eb-951d-455a-b82c-5f10c55ddde5", "sighting_of_ref": "indicator--24d8e207-84d8-4c85-9a46-07df1a9295ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c91f7ffe-389d-48dd-8cb8-9df746f33648", "sighting_of_ref": "indicator--44484713-27db-4aca-8c9b-038fe8cc88ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4cb0d4e-348c-4317-93f6-a8293eb96ef3", "sighting_of_ref": "indicator--ded44ce8-40e0-431e-904c-2833ea5ba819", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c11bfa1-0f3d-43cd-9624-7c435c4a320c", "sighting_of_ref": "indicator--8bfb3afb-fd69-422d-9d31-e681b5aa4abb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--244ddb97-4a11-4543-82fe-94e952379b4d", "sighting_of_ref": "indicator--0d782133-e8d3-40ed-99ad-51570bd16ff7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ea1e56e-8b6a-42aa-9862-4aaf997f1c99", "sighting_of_ref": "indicator--98c65ceb-c786-43fe-b404-af1a762fcefd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3782d86-b8c7-4d72-91ac-6ba1174501af", "sighting_of_ref": "indicator--ec313083-e237-4f28-98d6-0f3aab6fe6a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c50c19ae-6272-4dd3-9b68-302c3a6c4ae5", "sighting_of_ref": "indicator--5d3b4002-7e60-48ff-aad4-53f3ccdf0848", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e74002f8-1e84-426c-bb42-d3a272d9cfc9", "sighting_of_ref": "indicator--66024c97-7d71-49d0-adc9-92ef89ac38b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--537a44ca-d702-4d36-b57f-710def238fbe", "sighting_of_ref": "indicator--f0ff9a34-ed71-4428-b7cc-3aa780b03265", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--571e0068-41ce-4491-ac46-bbc316f1b3e3", "sighting_of_ref": "indicator--1e5706a2-7e08-4cfc-9a5b-85a225533b39", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66d06e9e-d416-4b16-b445-e189d03338b0", "sighting_of_ref": "indicator--067218eb-758b-4f1d-b95f-b9e26676744b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ca32793-4d93-4408-a18e-a87d1bd5e26f", "sighting_of_ref": "indicator--4d6aaa15-7c23-485a-885f-1ecbc1dbd991", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb7db346-04f2-439a-8ae0-6e5445fd95d2", "sighting_of_ref": "indicator--7dfd81c0-6a6d-4134-83aa-7f6dc2811023", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b963ca0-4ba5-4bdf-9ff3-98e0c4b89ea1", "sighting_of_ref": "indicator--ff283ae0-9777-4843-96ee-af4b83ca7956", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2830089-16a2-4a49-9df6-6ecf4f723aaf", "sighting_of_ref": "indicator--9d17102b-4081-4139-966c-88ca6d030832", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0670584-235a-447b-a08d-ed11e3bde895", "sighting_of_ref": "indicator--4df247a0-a11f-468e-ad49-2cd5e2ed570b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ba2b96a-2a86-4d43-8983-aa1b0f203566", "sighting_of_ref": "indicator--ccbeea64-1b7d-4735-aeba-f5a025d91972", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7c8e89f-e666-4940-9937-5a5805194f0c", "sighting_of_ref": "indicator--b0cd52a8-c951-498a-a387-1b21be53dfe7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45568371-cbd1-40ba-bc01-586202ffd405", "sighting_of_ref": "indicator--f8104b93-73db-4bd7-832c-8aa429815914", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48d56927-e773-400c-aabd-25a0a75c92f0", "sighting_of_ref": "indicator--48182d62-baa2-4715-a9ba-d6cadda36754", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96a6ebc3-0140-46fb-bd28-9ab6e78759f4", "sighting_of_ref": "indicator--553d820b-04fa-454e-9c8c-36e846dca080", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b2ff392-b886-4493-b281-d6ff6c2d9cb4", "sighting_of_ref": "indicator--e878ff3b-34a8-447e-a2fc-0b453f798fc2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69535739-7e3e-430f-a5be-f06a2c94198e", "sighting_of_ref": "indicator--af7a5c48-8b85-4396-afa2-c9efcbd0a284", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f3b1c0c-edb4-4dd8-9dd8-a683fe2c8fff", "sighting_of_ref": "indicator--74d7d87e-69a6-40d4-93b4-69a5cb95306a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0714dd1-1d5f-4c35-b2f0-4b5362b43bd1", "sighting_of_ref": "indicator--d789aaa8-97c5-40b3-8d33-432dd2f9636f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbae6063-15d0-4661-a465-18bd70cb1f57", "sighting_of_ref": "indicator--b11dd782-7b30-4a13-8621-521edbbbb8f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68b95dc3-fa41-4ff0-ba7f-10337d859a49", "sighting_of_ref": "indicator--0a682285-4498-4933-819b-0ebe28a30b58", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46c69df4-fc47-4341-86ea-9aa9d2422fb4", "sighting_of_ref": "indicator--b5430c73-48b4-4566-a667-0300a29fc2e6", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75d407af-3893-492b-8c07-369de978e086", "sighting_of_ref": "indicator--aaac5314-17c4-4d2f-8aea-b959ba6e3ca8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be29aaa4-3a2e-42c8-ac91-91341303ba10", "sighting_of_ref": "indicator--03434a8e-f8ae-4e8a-8685-e327cd54b168", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7832663-0adb-44d9-9746-0ac4ce0bcb18", "sighting_of_ref": "indicator--a26f3917-e275-4838-a1b5-5b8a102359b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abedca3a-02fc-401f-a7bb-422a4c1a2f6f", "sighting_of_ref": "indicator--a1fe3289-c7c8-4d76-89f2-2eea3956a888", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02e7e141-7e3e-44be-a935-2af7fe52a1ad", "sighting_of_ref": "indicator--89ed9e88-9d75-403e-9740-f8049abce8b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd81d94b-54d0-455a-965b-85d4d1584b2a", "sighting_of_ref": "indicator--f2e58b63-32fb-4e13-b36f-af3ba9c37a68", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42c455d6-5ced-45c8-97c3-f23f80195ed9", "sighting_of_ref": "indicator--7253a2a0-8fa7-4433-934f-1d3f21f062d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d6ac217-9ae3-46f2-b33a-e5b497c71f41", "sighting_of_ref": "indicator--97200a72-9030-47f7-86e1-58fe88272500", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--046ac96e-aed1-48e9-8180-029ac5cd18a6", "sighting_of_ref": "indicator--54c5ff1d-153c-4e04-81c0-00d71910c91a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4f411ca-29d5-4a6c-88af-95d9ed6f7389", "sighting_of_ref": "indicator--8dea9dab-92b4-44e5-b927-d10d3ff6f2a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2ac88e6-fde4-4063-90bf-214231f29f2e", "sighting_of_ref": "indicator--278d3407-169b-4c75-a887-e0ead15b1b40", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5e753ca-d7aa-41fc-a4ba-8d9519e0df4c", "sighting_of_ref": "indicator--a754626c-4c75-4710-a1e5-f30f71652a5e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc530b9f-3bf3-4111-b4e9-88e892e33117", "sighting_of_ref": "indicator--01ed3d6e-4c20-44cd-82db-ed5ad0dbfadb", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e5b00de-d5fb-4d3a-9d9b-48fe8a81bed2", "sighting_of_ref": "indicator--5b981e32-b4e9-4dfb-adfd-e45fd63fb335", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3b84803-ce03-46a7-8996-6cce9fcc4eee", "sighting_of_ref": "indicator--146beb80-7246-414c-875a-6fd0772795ad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--480a548d-b51c-4d3a-b9d5-425bd05e0de7", "sighting_of_ref": "indicator--ede04cc7-f1cd-4621-bbcc-06272fbf7b26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d67d007-edbe-4ca9-ae7b-6e582e9d7cd7", "sighting_of_ref": "indicator--7ace8c52-6ba2-447f-b845-69477bda86c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2be7d1c3-d18f-459d-a281-7f362de8e03c", "sighting_of_ref": "indicator--46be20d5-f457-43b7-9f79-74ba7e518c9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f324bab-508a-4c48-9dad-a0a0f11755f5", "sighting_of_ref": "indicator--8b5514ce-c573-4a6d-95d0-68bf7a49f5c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8a3f81f-32ee-47a5-b2e2-b95fca53373a", "sighting_of_ref": "indicator--d5da98a4-3189-4920-ad05-2d29a8a040d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbe32bd9-002c-42e1-ab6e-8550a8901062", "sighting_of_ref": "indicator--715697cf-8b26-49aa-81d3-21d0a968d0b2", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ece2d0de-1aa4-4330-90af-273435ecc4ba", "sighting_of_ref": "indicator--eb1b201b-e768-4033-9f5c-c62a801d8865", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dcd22de-2794-4b12-bb9b-b23cf12c5c54", "sighting_of_ref": "indicator--ad0b2f5c-c09e-413d-8537-bbb4ab69fafd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ff52abf-bb04-4bdd-b613-eee25f13c163", "sighting_of_ref": "indicator--8bb854ae-666c-4beb-b266-ed82db9d1187", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c10611f5-fd85-4bef-b1c1-bdf317b48ffb", "sighting_of_ref": "indicator--ef2fd1a4-2d52-4c0f-a26f-45a0825e5c0d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--735fb682-70e2-4523-b754-b438217406ac", "sighting_of_ref": "indicator--55ebf57d-9da3-45cd-842c-055a22bee7fc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62a253c7-8369-470d-9b1c-9ddf4b9bee3f", "sighting_of_ref": "indicator--fcc8a40d-a60b-4517-8b75-abb11ed16a9e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--613cb7db-d6ea-4ea9-834c-d8e430dd0d9b", "sighting_of_ref": "indicator--92d1c2dc-2534-4343-a42e-03865695fb3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3c19eaa-949a-4267-b6c8-b302578a9bde", "sighting_of_ref": "indicator--92da0d35-b9a9-48ea-bfd0-d8c95ad83b78", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d5be3db-2175-4d54-adf1-17dfc1bf4eb9", "sighting_of_ref": "indicator--fd7694ad-e298-48f4-bd4f-77602de602d1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6732960b-b550-4831-850c-411066e98637", "sighting_of_ref": "indicator--06937cd6-fe81-452f-8598-3366b5eef995", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b44d26d4-fb4c-44e1-ac15-7563056f10a7", "sighting_of_ref": "indicator--48e16b6c-7b5f-4b3c-b70f-1f37a22249a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fb230bf-788e-4af8-9380-1282edca70a1", "sighting_of_ref": "indicator--d7762bc9-c4e6-4089-98e4-516281482508", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c97e475a-88e4-4aa7-9750-024335bec2d6", "sighting_of_ref": "indicator--1b6bdb3e-bf56-4372-848c-c34a9104c5cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9f201d8-b8a7-4eba-9ac1-1869720ba1f5", "sighting_of_ref": "indicator--48935b4e-dfa4-4c19-8187-806d0deecbf1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f7cd025-1292-40d5-b456-7548018f3495", "sighting_of_ref": "indicator--bf9fad15-d0e3-4c9b-9033-9b9961b2f12b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01be0dd6-5791-4422-8e0f-60915ec06154", "sighting_of_ref": "indicator--19c2a034-c2a6-4ff0-b8c1-837a22e966f8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--416b74c5-3d3d-4ed7-bd4c-872d919c0688", "sighting_of_ref": "indicator--3086f27a-82a2-42a2-9c15-efc494ad8340", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31ee81d1-d860-4bd6-85ca-7c0fe1e6535d", "sighting_of_ref": "indicator--473e2cba-ea32-4c92-af09-fb95fcf7e0a3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ed09ac-ecea-4d59-a855-da4a821310e9", "sighting_of_ref": "indicator--311c76aa-180c-4e68-8660-60043e8220b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--801e839a-78a8-4408-ac47-cef71ee2c5a3", "sighting_of_ref": "indicator--a3fd75d4-565a-4079-a017-48aa457cb86e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--171f8a7e-447a-487d-bdee-86479f057714", "sighting_of_ref": "indicator--25e72e8c-b7e3-4492-bde1-ef2bb80cef96", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c08850dd-c022-4bc3-bbb3-0c25127c6797", "sighting_of_ref": "indicator--e7b050ba-c7e1-4cf7-881a-99ae8721f96d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0fd5a4b-8df2-4799-9348-9c4b494bc54f", "sighting_of_ref": "indicator--ae6321d6-cc1b-44e3-873b-438353118868", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab251870-6a88-4c90-9e05-dfeb7b6c4be1", "sighting_of_ref": "indicator--fcaaa577-e5d0-4ea6-bae2-89567ff578be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6706eac-443f-4ad5-8f2b-ab7735571cde", "sighting_of_ref": "indicator--710ae96e-eb6e-4396-a569-6d63deec4d54", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0c484a5-0ab6-4d1b-8181-849aad2db8ae", "sighting_of_ref": "indicator--a7cd4f3d-e4ad-43e9-9488-698fab265883", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70adeb0f-721d-436c-8b14-6cbb13624589", "sighting_of_ref": "indicator--7afc82ad-815d-474c-9443-8c4923f749a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e449d13d-3983-4876-93f2-ad68c8ec45fa", "sighting_of_ref": "indicator--936b6dbd-32cb-40ca-b424-9ee449afaf5e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47042e0c-72f1-46f1-b898-dd2560d3a39f", "sighting_of_ref": "indicator--60b1102e-2b64-4832-8f79-be81edcf67f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc60de8e-77c4-40de-9600-85eb3866b522", "sighting_of_ref": "indicator--7560e3ea-3672-4c34-a34b-f49534186e60", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--991e019c-40dc-4988-8da2-8eb7a4646c39", "sighting_of_ref": "indicator--cd380e19-384d-4df9-8963-706a57ab3f54", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7ccecfd-5924-4776-a7b8-0c533ee0875d", "sighting_of_ref": "indicator--2c392b91-8ecb-4bde-beb4-a8daf3ca4a3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4515fb6-b133-479f-9f94-5baf6df9d255", "sighting_of_ref": "indicator--4e141310-d2c6-48ce-9143-89c4657fd952", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47685223-1725-4f9c-8e9e-0f8b550d95cc", "sighting_of_ref": "indicator--4a6c34aa-700d-4ebd-a85a-02fe1a171e7f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7de2a7bd-3d81-43a0-8f6d-c390c8bf517f", "sighting_of_ref": "indicator--8d1ef3dc-77f7-4c67-a94a-9445e093efe8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deaa4e27-8ea4-453b-aa75-69852759a31e", "sighting_of_ref": "indicator--812343ca-281f-461f-97b3-9c545fdf2415", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0980b20a-7207-4f90-8442-fd4393735dc7", "sighting_of_ref": "indicator--c1e727ad-7eab-47c5-9506-f82332f30983", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d25d1600-69d1-4d29-8b03-44160d0b0ded", "sighting_of_ref": "indicator--26f17626-ed17-4579-86d7-df3df14b8d61", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d4fd453-8563-4b8b-8857-06c4ff08bb56", "sighting_of_ref": "indicator--05f06472-213b-47ff-8974-53f4bd74d859", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a24938ea-e232-4db0-bd25-c8cb7fbff2a5", "sighting_of_ref": "indicator--e9ff5abf-4fb7-44eb-a11c-b774de48b1f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c08604e5-b968-4e63-93d2-876427b0513c", "sighting_of_ref": "indicator--832ae06e-7680-4304-b1a5-4fd0114217bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf209404-99c7-4f99-9d49-7ec0ec8c172d", "sighting_of_ref": "indicator--c79003d8-e54d-4413-904c-2427e6026b07", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7edda4a-859b-4307-bfaf-e2554ed73c13", "sighting_of_ref": "indicator--56fd831a-d6f6-43ae-8f5d-833ae41c0010", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bf40f9e-cef7-4c90-aba3-c820434d06ef", "sighting_of_ref": "indicator--94e70ad0-3efc-40ed-a5ee-14565e21a5d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4fcd8b1-1ed3-4733-9ed8-cf99acefe2bc", "sighting_of_ref": "indicator--de218b8a-e62f-4ad8-a503-4480019bf89d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b913da5-a4ed-4303-8167-bc4c77270e0d", "sighting_of_ref": "indicator--d6257ca9-469b-4062-ad84-9d3a88eb9360", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3fa459f-1c1d-4f7c-a560-af7bb4f5f54a", "sighting_of_ref": "indicator--4fe84f29-bbbe-4157-89bb-16648637eb31", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23641258-305f-4573-8bb7-e05e053efe39", "sighting_of_ref": "indicator--3c76d557-fd90-4b04-823a-63b0d95d38fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea544b4f-6340-47e2-9e5e-4a99eb892a28", "sighting_of_ref": "indicator--1e5f8192-2434-4d55-99e7-e6de74b149d7", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b50c2e7-0fb5-40d2-b05e-bb24a6650af0", "sighting_of_ref": "indicator--5fc8ba54-ad49-4f0e-b263-9965476a64be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d8bc722-cb24-4ba9-98d6-919a3cde4159", "sighting_of_ref": "indicator--c0e31fd6-726b-4892-b875-0006f556cb39", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fde8e8c4-b5ee-4ab5-84c4-2a57627de2e2", "sighting_of_ref": "indicator--23b5393b-d782-4704-bf14-f9171b49616f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0c2bac4-e657-4bd2-be5b-4db837c71507", "sighting_of_ref": "indicator--906b7d43-3d26-4218-baf9-aec6e760449a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18a827b7-7e06-4cdc-b9f4-bfb7e5cd78b0", "sighting_of_ref": "indicator--6f6bbd28-f512-40e2-a101-04f2c9701866", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--921914de-263a-4c59-a2c3-f125a30c821a", "sighting_of_ref": "indicator--d7878159-783d-4e00-acbb-496aca181156", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31711d1f-3a9a-4c70-839b-e49ff496f57c", "sighting_of_ref": "indicator--30bf861e-2c1a-4912-a1f9-20e11d55a7b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83959660-9f07-4dc4-86f0-fa9275937d63", "sighting_of_ref": "indicator--110d6da1-b3fd-470b-97d7-1f3f9fa78694", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d416464-21f3-45b9-b5b9-1a8c716d2817", "sighting_of_ref": "indicator--9c8a774f-0b38-4889-9112-f85e789ebcbe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e8faadf-9110-4dc9-95e6-70d97c8839ed", "sighting_of_ref": "indicator--c8462791-bdeb-4f5f-a640-26801a00ca7b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e3cebac-47de-483d-916d-66d722bc00b0", "sighting_of_ref": "indicator--65e52902-1011-4e01-9a77-e17a7d16ef6f", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2a274fd-38c1-4bbd-aa43-9848ae8a35ab", "sighting_of_ref": "indicator--d3d8d6d6-a031-41c6-b9f4-3f1ac2f8c043", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f96d9d3-3478-46da-b467-4c30b4b7fa9e", "sighting_of_ref": "indicator--a2aa0d9f-5aeb-45c7-83b2-ed319c2ea4f3", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15aacfaa-d97d-4e30-9465-d5786db164f5", "sighting_of_ref": "indicator--664559f8-67e6-4bfa-a175-dd9131f027ca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87f7e64a-59ca-4518-969b-a2a9e84ec5fb", "sighting_of_ref": "indicator--00decc35-c55a-484b-8149-032787a09c1c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edb56bd6-872e-46bf-9713-5fbe1d6a1481", "sighting_of_ref": "indicator--c6106657-75e3-4c26-8230-620d238a0280", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7d11bef-17a5-4853-90f8-cf79cf453fbb", "sighting_of_ref": "indicator--750d9519-ab70-4a19-b3e5-92caabd4cd59", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b145d7-d2cd-42d2-9c05-e8972e30da18", "sighting_of_ref": "indicator--92eed769-5d8d-46b6-b89d-0e10bf02d347", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37968878-c956-4e6e-b72d-72fcba956b1a", "sighting_of_ref": "indicator--92d516a8-777d-4ac4-a124-93ab27cfc497", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bf0dd26-3fe7-4da8-bafa-08b1c3fed430", "sighting_of_ref": "indicator--43a9acdb-02ff-4b28-bff0-149981f92ce3", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12687fd8-f525-40d9-a417-34311b1dfb22", "sighting_of_ref": "indicator--85d052d7-407d-4f4e-a8c0-54e858e2cbe6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--840d2b8d-cd22-4c91-ad6b-cbb9bd4e992d", "sighting_of_ref": "indicator--e07079ee-8566-43e4-b690-cc39dd1f4c65", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50119345-e540-4e47-a94a-2b4974294f3a", "sighting_of_ref": "indicator--e0473c89-e964-41ed-baf1-c8981de4dcf9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61546999-9e5b-44f9-ba2f-c83ed7b053d5", "sighting_of_ref": "indicator--c2fdf7ee-5552-4971-9c02-8fc2745633da", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56ea99aa-ddea-4f72-ac33-e70247c489b2", "sighting_of_ref": "indicator--12752951-1033-4079-b3e1-37ee0ea9b98b", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c43867-9b8e-482b-bda0-f6f01b9d4450", "sighting_of_ref": "indicator--02f8e4c8-2d04-40a3-a587-89609fe2b5b3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75719de4-fa12-4fad-a0fa-1cf1dae402fe", "sighting_of_ref": "indicator--e5175d6f-ba0b-4beb-bd32-6d203e9d5b02", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a61e5c11-6e8d-42fb-8a94-633b11f887c2", "sighting_of_ref": "indicator--b98c78a3-e16b-45ab-812d-837f0bb7d2c9", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5380a1ca-6202-4c59-9119-e662d358e12d", "sighting_of_ref": "indicator--694e4f45-9678-4f99-8ae7-4b9f35174335", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d8a68a1-ace8-4d94-aed0-27ac42a58a1b", "sighting_of_ref": "indicator--5ebc64c4-bfa4-4f34-88a6-c81de4763831", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f256186e-a6a3-447d-9f6e-d9a6075c3bca", "sighting_of_ref": "indicator--0ba203ff-d239-4d52-ae01-7a33a81b3807", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11fb0402-81ff-4bb7-b9fb-cc9185756e55", "sighting_of_ref": "indicator--b77f8669-8b7e-4ca1-a39a-eb19747f9c15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ec62a8e-048e-48d8-9073-5a5764e181f7", "sighting_of_ref": "indicator--06efadbb-292a-4599-8a03-020562a06ab2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb358ed0-46bd-4fca-8ad7-5fb2230f1e68", "sighting_of_ref": "indicator--a568e904-efcc-4c03-afdc-1403de9afd4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cb27b32-2587-48ac-acb1-67a0419c5372", "sighting_of_ref": "indicator--dad7f367-2ba3-4b50-b74b-53d8b8a49786", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--607b213f-7d69-481c-894e-b713fbd1b189", "sighting_of_ref": "indicator--7ed79638-6619-4e56-ade2-bb965a4bdab9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c3230ce-e818-4a69-8957-f5ba88fa88a4", "sighting_of_ref": "indicator--0e72db35-c96c-4add-87f2-92b09bb248a3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ca63240-caf3-4f0b-8af3-1b7a0674cb75", "sighting_of_ref": "indicator--8959c0df-27ad-43c2-948c-a595920ac322", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--679bed1b-2b4d-49d5-a1b8-1d88d21bcee1", "sighting_of_ref": "indicator--8cfd3fc9-2028-4dfe-850e-89740f47fb12", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4090aa5c-e367-4f53-80fb-36502d46e790", "sighting_of_ref": "indicator--e81cf067-e363-45d6-a60b-43300369ecc2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9547adbe-5433-43bb-b504-9e25081c2b4b", "sighting_of_ref": "indicator--7d5dbf5d-43fb-47ef-9ce8-cbefd91020d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d7426d-a921-4df5-96f2-ef4bfd3a4b05", "sighting_of_ref": "indicator--dd668ad8-1c41-4401-9554-39a30893d32e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1760b371-bd57-40d7-8e96-afe3f66028ff", "sighting_of_ref": "indicator--8a7e1a67-5816-4b6b-bd44-cf6c330ee8ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a30e2567-e8b7-4ce6-9fed-8ebffef9c097", "sighting_of_ref": "indicator--62834f19-11c9-4ade-bc41-a95d2385f466", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abcdd7f2-23b9-4360-818a-de14d1cd0e33", "sighting_of_ref": "indicator--3dd6c04e-c52e-4256-ae10-9739393d7550", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1440a5c5-a80a-4f31-994c-a1453442d707", "sighting_of_ref": "indicator--78c02baf-17ba-4f36-9a67-01f2175e551d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ad3c8e7-7878-4038-a888-79b15706d368", "sighting_of_ref": "indicator--1f624824-3e40-4815-b78b-dc8fe6078706", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7678aad3-8754-4783-9f30-c19e736f8fa8", "sighting_of_ref": "indicator--a667b0ec-27ea-4a87-90e1-ce1bb20d026b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fbe3cb3-0a3b-472a-a9ff-0d8abc28dcf2", "sighting_of_ref": "indicator--2058f03a-cc33-4769-a195-0d2962fc4165", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcc2a4d8-4895-4338-bf58-2443d1afbc5c", "sighting_of_ref": "indicator--84f07a6c-e37d-4d55-8b25-e51e6b1cd3c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1623f68-04e8-4622-be16-248959dc70b2", "sighting_of_ref": "indicator--b2a663da-bac0-48dd-8bf4-92d7b63c73c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--855fca53-b609-4a51-ae4d-11516f9e03eb", "sighting_of_ref": "indicator--9ed57450-2bf4-4126-82cd-7b0aefd7924f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abefa0f4-3b42-4441-8945-b6c5010090d3", "sighting_of_ref": "indicator--9acc1952-2171-4f23-a2aa-711232f5a1be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0f4952a-4a54-4123-9a4d-232de03912ef", "sighting_of_ref": "indicator--797e12e6-bf80-46e3-9f25-09719b10b07b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd251673-f152-4180-9111-7b3992505b23", "sighting_of_ref": "indicator--89f549df-1621-40c5-a874-6b80ad23230a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f025bfd-0291-4e8f-bdc4-d35d58201057", "sighting_of_ref": "indicator--fba5cf37-0f8a-460e-b7e9-bd5e377a3001", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--375a68a5-4cee-46e0-9080-5a8a255ca853", "sighting_of_ref": "indicator--3a9cc54e-3f61-4531-8958-181290af0f03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43d3318a-146f-4da3-b3a8-118de23cdec0", "sighting_of_ref": "indicator--9b7754bd-0965-43b4-8bad-0c4dd76712fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea5a56a8-dcd0-434a-8f9b-8b873a138d18", "sighting_of_ref": "indicator--042124c3-b663-4ada-9aaa-6c4c59c5ac5a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3320c907-ab98-411d-a175-3a0232787ca0", "sighting_of_ref": "indicator--fba2fd4d-4692-46be-a1d5-f2138dfc69e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc262e61-fa49-486c-96fe-180e1331b3bb", "sighting_of_ref": "indicator--ea451a07-99f8-4642-88e2-b0c2e4f37c72", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--519d9152-af3c-489b-b29c-239962ecbbec", "sighting_of_ref": "indicator--2a79dd90-e47f-411b-a114-ec823bb4d8d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f5f5766-6921-4e54-bd09-8d4265cfa849", "sighting_of_ref": "indicator--e019fc47-4e66-4604-b268-4f8817268761", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7c80992-8f7c-4c6f-ae08-494cf1d7af0e", "sighting_of_ref": "indicator--c5aa4d71-94f0-4cc2-9eaa-777c51ec96a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d42976e-cc68-4397-abbf-e8dac2b10aaf", "sighting_of_ref": "indicator--9f2ad5c7-79e2-47da-a4dd-e36e45562c07", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd53e765-a108-49cd-834d-4d2b63f85d30", "sighting_of_ref": "indicator--74ca53d1-def8-4dc8-bb82-86b9ff757b2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0241f49-0a4d-4cdb-8ac1-323bad105601", "sighting_of_ref": "indicator--42b1da00-4a2c-43d5-b5b1-86a653ac3106", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--664b34f8-3846-4bcc-bfc0-60a47b196ff7", "sighting_of_ref": "indicator--fd20021b-a77e-4085-8a6e-a178eb9ffa95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4bb4b86-a630-469f-acdd-2834db73cb40", "sighting_of_ref": "indicator--d1bca352-2e47-4aeb-9081-58e28609ce2e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aadbcf61-c36c-4f07-b613-0d66365d7fd9", "sighting_of_ref": "indicator--0a548516-9393-4534-8eac-9e0cdcffb467", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4ae1413-3105-42a2-a83a-1cd15d28be03", "sighting_of_ref": "indicator--6c8d2709-8c5c-4f65-98fe-197376b0438d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b0f331a-3448-4b8b-9a6c-109a79331029", "sighting_of_ref": "indicator--83677e3a-7869-4a91-acc6-d4cb585ccc23", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25149a25-17b8-4dfa-90dc-463fba8b821e", "sighting_of_ref": "indicator--a1160ab0-2ada-4d5e-a78d-551d56e042c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d066bc7-ee85-4a74-982e-f81eb91d332a", "sighting_of_ref": "indicator--ceecbe68-e5b5-4493-9290-d29531c79091", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c4b85f4-85f6-4032-a67f-858b7f56b585", "sighting_of_ref": "indicator--849642a4-f77a-452d-8c83-93341da5ccbc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--470328f9-df1f-4db0-8715-9c92d78a4fc9", "sighting_of_ref": "indicator--cc890e28-0ff4-4d03-a429-12f6f270e4bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c62b4319-b4f4-47fd-8c5f-fc61448c20f8", "sighting_of_ref": "indicator--c5f6b9ea-adeb-4318-8ee1-8bfd9cb7ed6a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca6b6cc0-b5e7-49b0-87fa-4d0a57b0b447", "sighting_of_ref": "indicator--14da161a-8d9e-4e4b-a8c4-9a3afa5e1fbc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bf06aff-da90-486d-b391-87a4e96c3d2c", "sighting_of_ref": "indicator--2cb7cc33-3f0e-46f9-975b-e7903172dcee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36bc4e61-abb0-492d-b1a7-3bd0ec8ff316", "sighting_of_ref": "indicator--519c6804-26b2-4bd6-a0c6-cd69b26215a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--768615ef-542a-4c46-9c38-1cba121cbb99", "sighting_of_ref": "indicator--1db31047-6aed-467d-8fec-abbe27e3f17b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48fcf68e-2ada-4a4d-8b2e-3801573f02f7", "sighting_of_ref": "indicator--7523816c-a9d5-4988-9fa3-a1871b0c659b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd63f01-43d6-4355-afc3-81f665746a4a", "sighting_of_ref": "indicator--ab2b2089-1b9b-429a-bb40-b27743fb3b2c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef776c5e-3c7a-4f2c-b22a-c68700d3fe98", "sighting_of_ref": "indicator--1ba1f4c1-a9e3-4999-b8e8-88b0d592e749", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a823ed-c409-434c-9ebe-d69340fbd5b1", "sighting_of_ref": "indicator--8556f03d-5a3b-4e1f-919e-57f675380069", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff9645eb-9440-458a-abd8-01d5bf47d1da", "sighting_of_ref": "indicator--df4c4800-5587-46e4-bc9a-59d79f4d78ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b818ac4e-7311-49c7-ae66-8aa33a67f4b2", "sighting_of_ref": "indicator--46a8c423-e84b-41b4-bf2f-cf92212c7ef7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--380d44d1-dcbc-45a0-9ee9-aafbd7b4fdc4", "sighting_of_ref": "indicator--47e02817-e5ea-4582-b601-124cf7862b2b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a273c79-54c4-4ffa-aecc-9a33712867fe", "sighting_of_ref": "indicator--adc48c8a-6360-4977-a3c0-ec755eca9ab1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab891359-2ff1-4bbe-901c-05c7ce59e6fd", "sighting_of_ref": "indicator--edf3bbe4-7990-4fa6-b851-8f5dbd7be7aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99ac7f19-3e59-4229-92c6-473dcbf1125d", "sighting_of_ref": "indicator--5b27c30c-f2dd-4067-9688-3fb7af67464c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--975f9be7-aa04-4c14-8d47-a34f2514c16d", "sighting_of_ref": "indicator--fbeae480-fa39-4af0-8472-e0db9c8ed8af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee532c75-8777-424c-8b54-2a9102a4565f", "sighting_of_ref": "indicator--ae2fdc3b-43ba-4716-8591-7e7af0662e25", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d213b45e-e3ce-4a1b-8878-20641dda4237", "sighting_of_ref": "indicator--8ae5efb1-1855-4049-bed6-05d0529576c8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc704474-2f6b-4a1f-9d7f-01bb6e98384d", "sighting_of_ref": "indicator--3786c033-1a4e-41ee-a72f-b3061d541ce7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--333d7fa6-9e3b-4c24-ae88-410f34236e34", "sighting_of_ref": "indicator--53435246-0255-4bde-868a-c26830d64d41", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6cfd413-ffb6-4e4b-b8b3-ff158586229d", "sighting_of_ref": "indicator--f4609ee0-61d6-404d-959c-a03b1ae030ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92db125b-3230-427c-b6c7-7c4f6a65ddf3", "sighting_of_ref": "indicator--11f2bd12-f468-4d32-9af9-75381ad05aee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfd6a8fd-92fe-4ec9-b4b8-2db99ba8d604", "sighting_of_ref": "indicator--ed5e7f64-2a1e-4f2e-be21-353cc4d8d1e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3a087bc-bf7a-4cd3-9265-781807c70c1b", "sighting_of_ref": "indicator--99bc27a0-221a-4251-bebe-76d218a2ed7b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--963a16f2-9b04-40dc-ab50-393eefa653f2", "sighting_of_ref": "indicator--0580b7f7-64bb-401c-9bde-648ee055b6c7", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b4d364b-eae2-491a-80a7-ce06fe09002a", "sighting_of_ref": "indicator--e3701a52-8048-44ab-839d-720f54fcb9ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e811752e-80bd-4b93-969d-13d7abfafe4b", "sighting_of_ref": "indicator--3cd7e551-f079-493c-89c6-48c00c6ceb5e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5231721e-4d7f-4b79-a0bc-f9de3560420d", "sighting_of_ref": "indicator--a2a90251-597c-47a6-bd30-1f377ba28343", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7115ab5-f4df-4801-a642-611baf549cde", "sighting_of_ref": "indicator--97ff1a4c-c804-4d20-a2be-7cd720900869", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ec01c74-d422-40f2-b221-0bb7011edfdb", "sighting_of_ref": "indicator--eaae5a47-e485-465a-a5c2-75492674fc8a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10280382-a4c3-4edc-a97b-b5b728def891", "sighting_of_ref": "indicator--1dd7e66e-0b71-4650-b2a9-f8af05b71e6a", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59da9aa4-0e9c-4ab7-b9d5-5a2bbb6cebbb", "sighting_of_ref": "indicator--6c4ded1f-0b4c-4d0a-aeb2-249c0838d91b", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0094d587-b490-4785-a9a6-57dd00ed4d00", "sighting_of_ref": "indicator--59694e43-de8e-49c2-a41b-2fb87a872e58", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d2a1ae-1a88-43fe-bcd3-b060aa1d8d4c", "sighting_of_ref": "indicator--d30cb80a-d524-4e14-8e93-5dae1bd560ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09a5e4bd-ae40-4e9b-a50d-8758d410fb0d", "sighting_of_ref": "indicator--f283cdfe-543b-40d1-9c4e-aa1a8f8ab89d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0774b74f-3040-42c7-a51b-667a20041dbb", "sighting_of_ref": "indicator--4f03e5ef-7e86-42af-8746-a17ba7dc02b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d9b95ec-46b2-4547-b756-8a85e2c13ca5", "sighting_of_ref": "indicator--eba395a6-a1e5-4e78-8d5d-a35656ccbc66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d8ecf27-f0f3-4dd3-a9be-3e2f25ff6532", "sighting_of_ref": "indicator--a09e1cd9-1bc6-41a3-8602-b0817ba91167", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93424429-2a93-4c92-9d81-059283e154d1", "sighting_of_ref": "indicator--fc60d2d6-39b5-4c7f-b260-51ba64168f0c", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--460b42b1-7ba6-40b9-af28-252c63bad05e", "sighting_of_ref": "indicator--dd6d9f51-7de5-4072-9d76-6e15554b4387", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f0ffceb-d2e0-4422-b224-172523718a38", "sighting_of_ref": "indicator--bed3bb6d-6ff5-4a2a-9976-ff477b32ab7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88f8adf7-3b89-4b8b-88c9-fcd5ee3affa8", "sighting_of_ref": "indicator--0d2a99d7-8169-4c38-872a-37229d27e913", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--369b88c2-9c20-447e-a3ce-137f1e9bf170", "sighting_of_ref": "indicator--38ecef7b-5bf0-40fb-a28e-5411e41fcc95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--667b0a9c-f2df-46fe-b821-1190845e5110", "sighting_of_ref": "indicator--f6e6e681-fc2f-4c90-9643-feb71a6afba9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9ab429e-7263-4cc3-be02-fc7ce0733fc0", "sighting_of_ref": "indicator--dfafd177-af9d-443d-a718-e51c47bf142e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcfe4532-aabb-484d-8942-00d978a1e31b", "sighting_of_ref": "indicator--5231dea5-d8b7-4abc-be57-ee81d3ad78d6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd4b0b8a-0789-45fa-a239-2207e52b0e36", "sighting_of_ref": "indicator--c28514ed-26a4-4104-94b7-e829df8cad04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c6399ba-0ebe-40bf-83fb-a7cd8b9e6ba2", "sighting_of_ref": "indicator--e3552823-b134-4786-8c5b-a66ab1e4035d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfafd25b-befd-419b-b872-84139544c0b8", "sighting_of_ref": "indicator--b6f026f4-5e62-400d-a88d-225074a8f6ce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ab0a01-e840-40a5-940a-6cfd940d69a8", "sighting_of_ref": "indicator--05727bec-76bd-432c-967e-7cd255f38dd8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d53e8b34-2a4c-4304-b935-b2011b1808f5", "sighting_of_ref": "indicator--d1a19c73-0f12-406b-b348-9e06ad21eb46", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42fa3ca0-73b3-4600-b44d-16b65980be79", "sighting_of_ref": "indicator--f17ac003-ffc6-46b3-9275-7efc1ba7005d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c710fefb-da12-4a42-a4d0-47bf639f7734", "sighting_of_ref": "indicator--6b9a6e6d-691c-4d1f-97bf-a5a776e498d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d273db5b-5dcb-40d2-8689-6b511294daf6", "sighting_of_ref": "indicator--6c451c81-e2aa-4e5c-ad74-e868b0a03069", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfd348ee-387c-4eee-a591-993290b5abdc", "sighting_of_ref": "indicator--aab65341-1075-41f2-914c-857ac5628481", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b40df4da-8d98-498b-8ec8-fe737ee546b9", "sighting_of_ref": "indicator--b3025096-2676-4d55-9ddf-1fc30fe0e55d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfad0070-8069-4d93-a832-8e75e761aeaf", "sighting_of_ref": "indicator--d6808676-4e2e-4ab6-a951-336ecf9ba2a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82cc0100-0f7e-4ce6-8d94-00d109d20129", "sighting_of_ref": "indicator--bc36e996-e6c9-4455-af20-32490dc544d8", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--491736f6-55ed-4ba3-9d4a-1f0ee2ab2e03", "sighting_of_ref": "indicator--47fac9ed-20c8-4f01-8236-868ed79855a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3acf9cef-2269-4324-8998-22ef771fdb67", "sighting_of_ref": "indicator--53810b72-a152-44a2-ada8-15b0778b2d08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--655b6344-2219-4559-b324-c6bb18695f5a", "sighting_of_ref": "indicator--f65f4ff6-c514-4515-9282-2dda0a5794b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a42362d3-3828-4a6a-88e1-7ae805c1cd9a", "sighting_of_ref": "indicator--82eedef7-9d33-453d-aca1-174b8887f215", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c48fb81e-f7fb-407b-9268-32abb657fabf", "sighting_of_ref": "indicator--47ed009f-3918-4123-a841-c31ce1ead1dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c646c03-7e7f-4119-8ad1-c5e251865c18", "sighting_of_ref": "indicator--18659e71-ad64-4afc-9e59-b4aa1c59b848", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd138710-6ca4-471d-b4f2-ccd7f69919a0", "sighting_of_ref": "indicator--14906077-a0ee-4936-a479-a25bd2a1003b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--808e6ab6-3fcd-4031-9254-ec1b08e345f3", "sighting_of_ref": "indicator--ba8b4a60-771c-4fa6-afee-ea4ca829cfdf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8123c25-03f1-4d0d-a944-bf8b13c6d1be", "sighting_of_ref": "indicator--3c36e8af-dc09-4a72-acde-5d011c639d2f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f6a0a87-442b-4678-8b72-2c4beb2eb985", "sighting_of_ref": "indicator--de63fe7e-0aa5-480e-abfb-0988ce79618f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5c6fbad-597b-4340-86ab-15bafe07b449", "sighting_of_ref": "indicator--cf7426c5-db4f-4ce0-8eee-b3f15097a1b3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b94e3aa-5c9d-439d-bbf7-aa40d97837f4", "sighting_of_ref": "indicator--e33643ad-a9aa-45a1-8463-9d1567c81528", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c7043f2-a37d-4730-a85c-6bf4069fb203", "sighting_of_ref": "indicator--012d7dd0-d464-453f-a154-a99a4f18ad63", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a650ee5-7c6f-40fa-9f3d-1e71b5193405", "sighting_of_ref": "indicator--c57a6a0f-e3ed-42af-8058-3f8be04ad96d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5f2979f-4ad2-4e57-975e-177f5d81d69e", "sighting_of_ref": "indicator--9c6faf20-8482-49ca-9c89-253b1c0f87d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--481e3fef-b646-48bb-b03a-7b008ec4a3a7", "sighting_of_ref": "indicator--96cf1edf-9e4c-4567-a310-75d472f2aed0", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a553ac6-7791-4371-8f4a-ef5fb93e08b5", "sighting_of_ref": "indicator--a95bf9f2-3a0f-4e88-9e70-d6a15deb0bb8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c45f932b-c33b-4707-aa29-5798ff50eb1f", "sighting_of_ref": "indicator--e23f02d0-2e5c-41e0-94a3-70205e4fc699", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eca23dd6-8fac-46c8-8d98-ee97e722520a", "sighting_of_ref": "indicator--2e460473-2b47-49d2-a569-ebd8d6900f63", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d717dc1-3cfb-46db-8c04-2fd811505fbe", "sighting_of_ref": "indicator--dc0f3843-e46d-4e44-bd34-9f270c627b84", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edd544d7-584c-4863-b0c4-35ee77ceab5d", "sighting_of_ref": "indicator--8ba188e2-78ac-4722-b5b8-104d39ea25d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9236233e-4c63-40d1-9eff-ff783f25f750", "sighting_of_ref": "indicator--f7850034-e278-499b-9ab1-3e4fe8569251", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--034d5c99-e4f2-46c7-9b11-ec3ca225afd2", "sighting_of_ref": "indicator--45997937-920d-4725-8b7f-a4610850d2af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4d8721a-5829-47c2-bb2e-edef152ca41f", "sighting_of_ref": "indicator--26cb6698-42b9-49ab-8e58-8d62650ab4b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d24c950a-aa8e-46c7-84f1-f90c1ed9ce30", "sighting_of_ref": "indicator--3d3bf301-6ef8-4aa4-b1bb-44205331a09d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--083e604c-0256-4728-9c27-d390ff7f4ff4", "sighting_of_ref": "indicator--a776ff06-b9d9-4d21-8bb6-e124e5d5a66f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70398924-a900-4b8d-a1e8-2a69cb8aa2ce", "sighting_of_ref": "indicator--3c379eb5-5c43-4d96-8a46-ec9efdf0627c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--860ef47a-bd74-4627-8841-bb03725e5af0", "sighting_of_ref": "indicator--403dd97e-a659-4fc6-bc2f-4e2803633f3b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1f963f4-8da4-4170-b2e2-f6680d4b666b", "sighting_of_ref": "indicator--601a863a-a957-4aaf-b4a7-cd028fbfa76b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdf74c73-4d3f-4396-99fe-c679a3ba084b", "sighting_of_ref": "indicator--35e88452-22a5-487d-9ed4-797a8deb8dc7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ef7456d-94c5-422a-9c25-4c6f4e09f468", "sighting_of_ref": "indicator--e7840007-070c-4a30-bc1a-2543b4efdcec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--010f6946-fc38-48df-a4a4-f270fd118d25", "sighting_of_ref": "indicator--e0e21ca4-fa8e-4739-bc6f-a298c1dccb47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1b5d31f-0f6e-4f19-8b1b-750747712285", "sighting_of_ref": "indicator--ec335ff3-062f-44a3-924f-c9c1728281ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f054f94-d22b-4859-82ad-3187a224d08d", "sighting_of_ref": "indicator--8a1ecf26-10d5-46df-9663-b5dfd24f1212", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dfb862f-7593-4c46-9284-505dce39f95f", "sighting_of_ref": "indicator--2989759a-5f6a-446c-82ca-7cc8febafc86", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fa0b55c-de82-4913-9ead-5f3a2033fb52", "sighting_of_ref": "indicator--4ae4e36f-8303-4cab-bedc-5033d07e4ec0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c606754e-e5ac-4766-9f26-047b2ad22952", "sighting_of_ref": "indicator--12b89b3a-5837-42cc-b30f-89bd188bbd5e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39198d2f-2822-4e6c-ae90-0861b5f9d922", "sighting_of_ref": "indicator--451c8440-9afd-45a1-ab79-16c5b0d3bb35", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99573b2e-6a3a-42d7-9df0-436589362f09", "sighting_of_ref": "indicator--f18dbe11-cafb-4877-aa1c-8051d45fd4c1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41e40161-fc66-4e9a-894d-f68761987b2b", "sighting_of_ref": "indicator--e9cffdaa-e44b-4214-aaae-0920b7125b3c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3909a099-0e6b-41dc-956b-3085d9a4afa8", "sighting_of_ref": "indicator--7c3b6d64-c2f1-40e4-8bc7-47eaa331813a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a62e156-3c47-4723-afda-532004e04e3a", "sighting_of_ref": "indicator--8a2ed8a2-a727-4641-a2ce-9cd24e4e5117", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f9dfb0a-1ba7-4658-bb86-3309d510b737", "sighting_of_ref": "indicator--1d3437be-4c78-4793-b79a-39b0b76c7e6c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f67a2bbc-4a10-4250-a131-f1dc041c9ab4", "sighting_of_ref": "indicator--14474af9-7136-494b-9c41-63565e0c7736", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--700329ce-3acf-4846-9c76-7e6e0a123f6b", "sighting_of_ref": "indicator--e95b0e53-dc5a-45b4-b5c3-c7a2f9c68abf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe625a55-2119-4fb4-8f0d-286ffa944188", "sighting_of_ref": "indicator--6028ed13-850d-470d-a039-d402af3a5a3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c0241a7-3047-4b2f-bf0a-340df1355217", "sighting_of_ref": "indicator--b7f2d8cd-9d54-4aa7-b180-ccccde4108a9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90f4f8f1-70a1-4a6e-aad0-dc0c8568ed60", "sighting_of_ref": "indicator--df01a791-ebd3-4367-8174-0f2a93ab98f4", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7068e751-fe8a-4980-866a-dd7d6d90c9e5", "sighting_of_ref": "indicator--36793193-9418-4801-915d-25bd1c10bc92", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--231f968c-1074-4856-ad64-071e10532e03", "sighting_of_ref": "indicator--e76771de-7542-4124-96c3-8800453e465d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9822c1b-1b16-41f4-b16b-a6817118192c", "sighting_of_ref": "indicator--2b934540-7aec-4aff-8973-d96c540ff3fe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38d08a65-8d4b-4fe7-9dcf-74ecd577f0b8", "sighting_of_ref": "indicator--058e53d0-4b1f-4e17-a033-842884453d4d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d1436f0-9957-46c1-b71d-073e534f5a61", "sighting_of_ref": "indicator--853fc4eb-820b-4685-a18b-3ae72be68650", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--080d1ae1-2ded-4280-882f-3d2d2fdf330b", "sighting_of_ref": "indicator--a8e99fde-a8bf-4e73-adb3-f0182f3fb5da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14b74722-8c4a-417a-a937-4b127b48a88a", "sighting_of_ref": "indicator--e4dfdf04-2d6b-4be6-a868-f907836af509", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a05733b8-b125-4380-aa93-21693136775e", "sighting_of_ref": "indicator--dda9ae7b-5918-42c9-a7f1-b80bf11076a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c05a05fe-30d9-44f0-a1f1-b281c5ea9626", "sighting_of_ref": "indicator--ea5ca49e-52d2-4361-a8cf-2fe300e5620f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ab346f4-dbfb-4869-931d-437ae29b5ca5", "sighting_of_ref": "indicator--1bd6d0f1-b1c9-40dd-9be9-dbb7c10ff07c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc4d3561-0598-4401-b43c-e913eda764c3", "sighting_of_ref": "indicator--d1515d28-65ae-4be4-86aa-19914f642ce0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b18d57e-78fd-4df1-8d69-53e8b941af3e", "sighting_of_ref": "indicator--82716971-5863-4f77-971d-219c29a7528a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a30094e6-7e13-4a7b-82c8-766f58a1897e", "sighting_of_ref": "indicator--38543485-2c99-411d-843c-ffe253372202", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d58a850-b8d9-4b87-ad5e-a8a2416666ac", "sighting_of_ref": "indicator--94a16976-cea0-4b27-86fa-bf007c7ca462", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44f5b403-7c0f-403b-9756-20d54c923b95", "sighting_of_ref": "indicator--2160512c-40be-4655-aee7-db991a386ea7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28838987-a45b-4cb0-9808-48f16c08f9fb", "sighting_of_ref": "indicator--640e3e9b-0e64-4e7b-816e-448fd7115a6c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beaec4fa-3083-4e5d-8bd2-1541a8e3c9f2", "sighting_of_ref": "indicator--532c8197-ada5-46b6-b961-aa1d1f65b6b0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d05207b-cf84-42f0-b299-4d769d238eb3", "sighting_of_ref": "indicator--8e135661-2507-428b-a8d3-1d24ffc824c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d014533-9c0f-4719-bbf7-7ac00f3b04ab", "sighting_of_ref": "indicator--5e9184ad-284e-41b1-bf96-4efd92f4c079", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dbcdfc4-51fa-44b0-9a8f-c187592bc994", "sighting_of_ref": "indicator--23c2207b-f884-4596-a358-f804bff799e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59ca08ba-3bbc-44cb-9d85-c98b4bcc8d66", "sighting_of_ref": "indicator--e9868283-46f3-4bda-9f8e-2a98b6f1f9c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab630eff-1f00-4f2d-a16d-7f71011b35cd", "sighting_of_ref": "indicator--517f781e-5b02-438e-ab5f-137eaa8b8c08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f24d6d77-5dc8-4bc3-82fe-945a38eb019e", "sighting_of_ref": "indicator--664f339b-37a8-415a-83f1-8f46b0d1ac29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a048b4c-4a04-4c9e-95b7-ba2b9e36504e", "sighting_of_ref": "indicator--14d7e9fd-0d27-4851-bd04-bd8476e007d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0ed2ee0-eeb0-45be-b2c0-aa320aed3c2a", "sighting_of_ref": "indicator--0d329219-c132-4164-b4e9-e96c6a80d705", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--914032a5-34a8-40e0-a015-a3d21c0643d6", "sighting_of_ref": "indicator--309c113d-7344-4e3d-acc4-3f691399fc0d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f632d0d-96bd-405f-abc0-04feb33f4a38", "sighting_of_ref": "indicator--8b5cea69-0261-47c4-8311-f4fdb14e098c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf09821a-9f9e-4e69-8b6b-a1461a049cfc", "sighting_of_ref": "indicator--80729fcb-6cf9-4a51-8175-f26737a47dee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1c89ef7-1e3c-4e9f-af78-0126faff983b", "sighting_of_ref": "indicator--8d66df98-facc-47d9-9ea8-852132a6b4fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4422e90e-b1e3-4713-9f79-bb9008f48b34", "sighting_of_ref": "indicator--73e191f4-bbd0-401e-bb90-5c8f2dab0ba8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a28fbaf-1f15-4b97-9235-a62cd1c878fa", "sighting_of_ref": "indicator--6d8976f9-56eb-4ba3-944e-99c0ff31a091", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02c487b4-6374-43ae-baf9-207b5cb06b21", "sighting_of_ref": "indicator--1e8ba418-7b75-42c2-ae5e-68795d86663d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbdb5c61-086e-4632-8556-9e9b05bc6b66", "sighting_of_ref": "indicator--d1b97b21-75d4-4b9b-980f-08182022086e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3352bbe-279b-4781-9e88-e728b7807651", "sighting_of_ref": "indicator--6d5a9aa7-121c-4df3-a1aa-64d77b1748ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2125f26b-cf20-4ef6-b2d1-c7838907a4a0", "sighting_of_ref": "indicator--b4053fe1-9957-44da-bf4e-e4927e336d4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ef4bb09-b898-4694-8f44-87b375fe3ec3", "sighting_of_ref": "indicator--49a1008d-4ec0-478f-80c9-f4758eb6387f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cac4d10c-d3e3-440a-9b62-b5552cce20ec", "sighting_of_ref": "indicator--15f61f03-32d3-4f73-9395-a79dd37a7bcd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3937595-e86f-4e20-bf83-0fffcac8134f", "sighting_of_ref": "indicator--5fd7b478-ee69-4038-8f5e-ae696be5d98a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b1872f0-0f2b-4539-9cf9-c32c661d2e2f", "sighting_of_ref": "indicator--cb9bcf8d-86ee-48af-b650-a6518b4e3026", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--605583b9-5caf-4ea2-846e-947b1f6307a4", "sighting_of_ref": "indicator--9bf00c97-3ef5-4c58-9069-ac6b9d24c38c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b9b0d3c-c015-481e-9cb7-0779ee5fb0ce", "sighting_of_ref": "indicator--9a890999-8754-4cc1-bbe6-064b0d9d15aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f407e033-2a48-4679-bfaf-fc7ef8c65015", "sighting_of_ref": "indicator--fbd94284-6519-4fdd-9f0f-9ef6206aaff4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65ae8601-24f4-411c-ad15-e37bdb0ddeed", "sighting_of_ref": "indicator--910f4f2d-ab65-4c8b-ada8-02f8e80f7511", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--195e9290-04e0-49ff-965a-7fbc6ffb3adc", "sighting_of_ref": "indicator--929bfe94-7ae0-45e8-b11c-423994fa606b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8bd1aaf-6c53-4f67-aea0-7e51c769d55b", "sighting_of_ref": "indicator--2df9d462-376b-4c34-98a4-39be6720e74b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d98fbab4-7921-402b-82e9-db9655c65453", "sighting_of_ref": "indicator--924a0afa-70d7-4867-b281-e82166c40343", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfef4b50-186a-4e25-9dbd-8a783d08014b", "sighting_of_ref": "indicator--1f97fed8-3904-4ff9-bb6a-e80f8d6036a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4751db97-5f40-4560-8ba5-a51239ec6cdb", "sighting_of_ref": "indicator--4079bf8e-c5ca-44e4-850e-6b20cdfc2ab4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--687fcf2a-f100-4794-8cad-c0c0f98837f6", "sighting_of_ref": "indicator--2bb141a8-206c-4465-a661-f111946d5ff0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0d1955e-6765-4fea-86eb-931488867d97", "sighting_of_ref": "indicator--9d60714b-92b7-46c9-a346-e8ae52e18576", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11e0f69d-6469-421f-81b2-ad1975509c04", "sighting_of_ref": "indicator--14fb5621-4abc-4ab8-b469-d9aaad92d67c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d518c347-f4a4-418e-8d9c-bc9600ff6ac9", "sighting_of_ref": "indicator--0e9c3165-addb-429b-984c-8f151cde7e35", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ca42936-e046-480f-a0f1-0f02bf6ac756", "sighting_of_ref": "indicator--ebce76eb-08cb-4bff-bede-8bcd954fc33c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1cf3d62-9c3a-4916-afa5-481b014c52e8", "sighting_of_ref": "indicator--be20aa0f-f7ca-42f4-86b7-449c457464da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01c531aa-aa58-4c47-bb49-32551a1e3bb9", "sighting_of_ref": "indicator--8bf41adc-b8ee-41e1-bc27-f26effbfedaa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13cdfd7b-10b2-469f-83d5-25349201973b", "sighting_of_ref": "indicator--b66c8449-85de-4d83-b584-381db42046c1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--816d6da7-6470-4fb4-9feb-333aa260fc5d", "sighting_of_ref": "indicator--f3f25d2a-7151-4c3c-8f40-0343d3b89827", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aed9387-87ef-440d-a3cf-ffffd5aa2614", "sighting_of_ref": "indicator--d2729135-d9b9-428d-abc0-65dac741b8bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e44d6477-82ea-456b-82e3-001018affd51", "sighting_of_ref": "indicator--de2fabd6-b5ec-4f6e-bba6-d940e049bb81", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1d85aaa-03e8-4d4d-8e5b-ea730fc805d5", "sighting_of_ref": "indicator--075b0c36-3909-4a0e-b34e-94e072dec0d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3d3dd6-c134-4da7-b69d-3f2c019f920e", "sighting_of_ref": "indicator--782996e3-632a-434d-a4f1-c1e5260e6944", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94c8ab11-5396-4395-bd02-76c7ad9b12e3", "sighting_of_ref": "indicator--3fa9cda3-a444-4ba4-b717-e0b7bb2f8da1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b7704c8-4ea6-4ad2-b3d6-bb798c0b6f20", "sighting_of_ref": "indicator--06a5c657-fb66-4049-8478-728d326eda07", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b2a3b3e-134d-4346-a58f-166af28871a3", "sighting_of_ref": "indicator--c22f3d0f-9451-450a-bfda-0eb8bb7b4347", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04cfec1c-8109-4679-90b0-2bb128250797", "sighting_of_ref": "indicator--18fc2fb3-34bc-4600-bf49-9f78fac11276", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a042834b-bd5e-496d-a731-daf950ef1219", "sighting_of_ref": "indicator--164c7504-bbc7-487b-94bf-6db26a793277", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0707ef14-b896-4694-8e12-724916e90388", "sighting_of_ref": "indicator--24f5631c-0c86-425a-862d-64d45072db06", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--691cc0f1-68ff-4aae-b9f1-9589eaae26fd", "sighting_of_ref": "indicator--f77411bb-b08a-4964-8988-962615733f66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7ebfc0f-1c3d-4241-b5f1-4ad68ea02f3d", "sighting_of_ref": "indicator--9b2b24e9-54d7-47ad-acd1-c2a04a860f47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--401d5ea8-19ac-4d34-a988-8eb2ac7ca94f", "sighting_of_ref": "indicator--33daf9c5-6775-4dd7-beb0-a2ed9d77b66b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deea2dca-8aee-404c-a95e-940f7de603df", "sighting_of_ref": "indicator--b1f5235f-a824-4fae-9ed7-f6b54341fc5a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6afa638a-495c-4550-8efc-4551a2e82493", "sighting_of_ref": "indicator--766ad268-1fb8-43b1-aecd-f8d098bb12da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da686737-2581-4584-8c9a-d9c082973ce3", "sighting_of_ref": "indicator--ca53b401-9a25-4917-97ce-34c385763513", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5d2fe1c-8cef-4af7-a7ec-0ce5ed42246c", "sighting_of_ref": "indicator--ad7ef9bf-0aaf-408c-b637-68ab092c6764", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0470811-b701-43d6-928b-31ad600c389b", "sighting_of_ref": "indicator--db4e5fc2-6910-49b2-85eb-3dbf286e1b43", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--509e232d-b002-4386-ac53-f496c6a1cb6d", "sighting_of_ref": "indicator--f9028285-c316-41b2-86fa-1e55136fce76", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c67a212-637d-4960-ab1e-18e4aa09d4dd", "sighting_of_ref": "indicator--cfce25f7-ca07-47ea-8bca-993b2b2369e8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35eb750e-a062-48b3-b3a2-35af238ae6c2", "sighting_of_ref": "indicator--1470d9b2-f39c-4f6e-aa06-00c547f0bb4a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f1b858b-37ee-4b3e-b610-22058ab50ceb", "sighting_of_ref": "indicator--85587ba8-5cdb-4858-9e13-754407fb0057", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7221874b-2813-4e72-b52d-640904fce799", "sighting_of_ref": "indicator--dea3e6ce-faa6-4b18-afa1-5d546e024fdd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78bcabf2-b448-4d90-9b3b-f7ba25283efe", "sighting_of_ref": "indicator--7ac72980-fa5c-47fc-8716-48936b4c3e73", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23be5168-d5e5-47ad-8228-a056cad56c64", "sighting_of_ref": "indicator--62d75e8c-0743-4476-be44-621d2c7722de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6562a98-cf26-4286-9548-1e22dd9a84d6", "sighting_of_ref": "indicator--a6e9831e-bd03-4f24-af91-017294c32643", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b44cbf-fd0c-43b0-8bf7-f80eace0f21e", "sighting_of_ref": "indicator--d80a9a3d-1c75-4ca2-9ed4-6070b181372f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46f2d3f4-c330-44aa-b589-23740579f082", "sighting_of_ref": "indicator--270ab32a-dc2d-4b3c-bfa0-af69188a6bc9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6439ca14-56b3-46eb-835f-16ccb7cbd35f", "sighting_of_ref": "indicator--c246926c-44bf-411d-9faf-fca14e40e08a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--252d08bf-5a06-4d7e-8e96-0f4ad6a2e64a", "sighting_of_ref": "indicator--97b10238-2975-413f-bb9f-0ec346b77a13", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73be71df-e68d-44e5-ab56-d69308346415", "sighting_of_ref": "indicator--96a8afd7-ee2d-4576-8bc9-b8d0dee84134", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be442e0d-08ff-42db-885e-ec29858b8df4", "sighting_of_ref": "indicator--b04154f3-1287-44bc-8e1a-351982afdb37", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7b490b0-9c15-4b03-914e-e1ab857a6fcd", "sighting_of_ref": "indicator--5b417e98-2257-4c51-9cbd-d4dd435b5816", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41c6f2c7-0c65-4745-9e3a-980c27590e54", "sighting_of_ref": "indicator--24996955-f15d-447e-8c4b-34344124521f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1e61cc2-c0e4-4b18-9a1d-8ef910e56be7", "sighting_of_ref": "indicator--81b9585a-1a3a-48ea-bfd4-ed5ff8a64db6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb820ff-c979-47e0-8ffe-8406ba517e2a", "sighting_of_ref": "indicator--7c85162c-3215-4527-8b97-1c37aca4bf13", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8540a613-18e9-4f66-b8dd-794d5dfe7210", "sighting_of_ref": "indicator--05812d49-b01e-48fe-952a-20c6d746d8ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe2c0c8b-d4fb-46e9-9dea-b887808317cb", "sighting_of_ref": "indicator--a6a2f8de-8081-412c-a218-5f18e73ba58e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8c38b5b-b3d6-4cd0-ae2a-e89c1063faff", "sighting_of_ref": "indicator--b5f50483-054a-4051-81aa-c0a4f8847ebf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33434159-320d-42a8-9ff2-e9a1811053be", "sighting_of_ref": "indicator--e0f17cb6-3b1a-40d2-a37d-3608dc83d6c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a718a7ff-09f4-4e07-87b9-71ecc2b19ce7", "sighting_of_ref": "indicator--6903f0e0-b337-4a1b-bb30-29d1b8e59f85", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7432e35f-feb7-4f51-b5ee-d49838912130", "sighting_of_ref": "indicator--3124df13-6d06-4183-be98-d8d3c43bb0b0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bfe10fd-6b30-450c-8fb2-e72bfb484c17", "sighting_of_ref": "indicator--99a0b897-adda-44a7-bb5a-3fdadadbe751", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76cc030f-1f26-4f28-96a3-549e0b36d32c", "sighting_of_ref": "indicator--61cd7839-d46d-4967-9070-fadf6370b6bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5691bf7b-421e-4d66-ad5a-4f3299e863e3", "sighting_of_ref": "indicator--9495a0f5-344b-4481-a2f2-42cf19f696ab", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d68ec36f-c5e1-4d3b-be17-a1e3ae5bf829", "sighting_of_ref": "indicator--d7d3b7d1-95ba-4c58-8449-2dc6c0cb800d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f65d06b-d6b8-479d-a127-52b48b1645e6", "sighting_of_ref": "indicator--9c444863-8022-418d-bcbf-0e38478a8458", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c9f669c-c2c7-498a-96b1-05415863ced7", "sighting_of_ref": "indicator--3e69781a-f6e8-449e-b352-1986d8bdef4a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd3e879-3978-4b7b-b32b-98cddb3f5b57", "sighting_of_ref": "indicator--a76ddfb0-bdd1-4f4d-91ce-f7a62bce4322", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdd77284-4a96-4501-b85b-ff5f9c6de391", "sighting_of_ref": "indicator--0008517f-e8b2-4560-9d59-d4d004a01a8e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eb39c63-992d-4f57-a3cf-344ac0fdbf41", "sighting_of_ref": "indicator--3029beab-a298-4087-9c4e-24c38e61cb17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a085957-c880-43fd-9827-91afa0a4e6d7", "sighting_of_ref": "indicator--35e03637-3331-40d6-8bab-93ecf935d50d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7532a16a-fe48-40c6-83a7-3b1dd76f90f9", "sighting_of_ref": "indicator--5da981a8-d1d9-47e1-8443-a5b62a880ba9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcb46cf8-82a1-497d-940d-f893863f2728", "sighting_of_ref": "indicator--3ffb7ab3-ef02-4c2e-96ff-cf7e45597819", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc9ae3cd-05cf-4797-a28b-00d0386f076f", "sighting_of_ref": "indicator--5391f54f-e2a2-4789-83d1-d3cdb13bbea7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--079fa15b-4451-4c12-bf66-5696d06ef3ca", "sighting_of_ref": "indicator--2d7232ae-6184-4223-8a22-99ba8d860391", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d65171ea-ddfb-4db1-a16b-bd2889a9a103", "sighting_of_ref": "indicator--94a7b501-b86e-4a4a-90ad-ac888dabf64c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82fc6bf0-74f6-498a-9688-3ba084ebcef3", "sighting_of_ref": "indicator--514820e3-008c-429e-81a5-e62aabb82722", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b952cae1-0fe5-4f1a-9feb-9c5af78fa367", "sighting_of_ref": "indicator--470fb181-9934-461f-b6ea-72f3c5566c1a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--039a898e-32cb-4fec-9ce8-39c46d62c881", "sighting_of_ref": "indicator--410d3762-3479-4c65-a682-6886eb047ca2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--278b9e35-eb0f-45e7-9a0b-d78b31d8ad2f", "sighting_of_ref": "indicator--c7faa44f-63a0-44ba-8e44-1eb85a82ce5a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be26ef29-ab51-498a-82a8-95a8447d6f70", "sighting_of_ref": "indicator--ad4f7b36-eda5-4fd0-b510-ab6d4e2aeec1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05ecb5c4-f643-4067-98bb-f09d6ea74452", "sighting_of_ref": "indicator--d1474c08-1901-49b0-9ecd-bd88e468bbb2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ddad0bc-220e-4798-8164-17598858d23a", "sighting_of_ref": "indicator--5f92fd3b-1b9f-4b97-a64a-f5189e1040c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a696142-5b4a-4c7f-a1fd-10c4734f4e4d", "sighting_of_ref": "indicator--412eefa5-f1c2-45c8-bb5e-31c1a57c181d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69409096-9d49-43f1-8e95-6742c76233b4", "sighting_of_ref": "indicator--d948d688-5038-40d2-b9ee-8f70d62a830b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98e9b98c-3213-4931-bd82-fb1a46fd5e0d", "sighting_of_ref": "indicator--7af60fb7-fffe-475e-9bcb-68627bc86dd6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c0ec428-3163-40ac-83df-0f0d97013d47", "sighting_of_ref": "indicator--1e8b6a74-7ec9-4686-8881-276a965cf6bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77d6afa3-0d74-47ea-b123-794bb5ef69a2", "sighting_of_ref": "indicator--f6af899c-b106-40db-b0c8-6bdb5dc5a866", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc966367-f421-4ff2-a769-885bb399df9f", "sighting_of_ref": "indicator--6af26d69-3cbf-4cc7-987d-7906a1365bee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92b0e314-e131-49df-bcfc-30eba44af158", "sighting_of_ref": "indicator--fac6884f-5d47-4f78-b96f-b8e4817f4d01", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9449c778-6e4a-4e64-bc3b-5419c13a32ed", "sighting_of_ref": "indicator--d6e551ff-76cf-43ee-81d7-7bd3f2c81aa4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8758b945-1a51-48e5-b0ec-8c5b2dcaaa97", "sighting_of_ref": "indicator--e23a990c-24c7-42fa-9632-d8b65a4b7662", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a7de54c-530b-4180-b551-c8947ca4aaf8", "sighting_of_ref": "indicator--b3b1f2e0-6364-42d7-bff5-ef04c1ec27f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6f4d5f8-7a76-4f9e-8650-6287cad68d1d", "sighting_of_ref": "indicator--9bb0e82c-e02c-466b-a2ad-f76fb60133b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3196397-9bc2-42f2-98c1-5aa318eb789a", "sighting_of_ref": "indicator--04647bac-a88e-4384-8ea4-2c54acea5eb6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd585222-4d8a-4df3-9feb-5905b014f633", "sighting_of_ref": "indicator--f85e0ddd-e24d-4974-b41c-1949f5892375", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f704de43-70ff-4ef1-9732-b63c61bfe3d6", "sighting_of_ref": "indicator--a43c7156-f115-4fab-948c-94a079350c76", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b65e2466-300a-4582-a5cb-2a7a1d91edd9", "sighting_of_ref": "indicator--ad2bf645-657e-492e-b21f-b61ec72adc06", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15b57ecc-3e75-41ac-8323-9548f86008b3", "sighting_of_ref": "indicator--82b7e9ab-e5bc-400a-b2aa-6c635b64e8b3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc51281d-9bb9-4fdb-8cc9-a23827229a3a", "sighting_of_ref": "indicator--710459a8-f4ee-4535-8092-6e5b92c929b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df401ec0-9220-4e13-8031-08a1b7818d4a", "sighting_of_ref": "indicator--42ed77e4-3b32-4568-a696-613cfe1e769d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa422ebb-2b64-4112-86a4-74ccf35094f3", "sighting_of_ref": "indicator--e89b8d63-3d6c-4a33-b73c-4c11258ee565", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb59f91f-8c4e-4945-bc65-1fec902079b0", "sighting_of_ref": "indicator--5c6e8f43-f9f1-4267-8ca2-534d61bfa614", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5187821a-7c8f-47ce-a34d-9d8b6eb31970", "sighting_of_ref": "indicator--723c9d80-436a-46b0-8bf4-c6ee1fc708be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66953c8f-e7bd-4f5c-9c24-c6928528057d", "sighting_of_ref": "indicator--ba91c71d-58bd-4dce-9e8a-b8f4d2dc7847", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8212f541-7a16-4797-871c-f8d63e4835e7", "sighting_of_ref": "indicator--819dcf3c-614c-48d5-9722-9e1bb051ffc1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcd1edbd-a69b-418f-870f-93fcd2712119", "sighting_of_ref": "indicator--625e9b00-ed55-4a5c-9c76-13677a842b7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9817bcc1-bf6d-45d4-ad6c-f213fc6a314b", "sighting_of_ref": "indicator--7a8071ae-8752-43f3-85a8-4c429d0b2f24", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--022d05c7-79cd-41c3-87b8-6ff8f9eb19d0", "sighting_of_ref": "indicator--6b7515d8-791c-44af-a72b-3c940618900c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1946ecb3-e0f2-424c-87aa-cad27dd4e282", "sighting_of_ref": "indicator--d21178e4-a7e6-4bfd-9fd3-aa17fdd96253", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e83979bd-19bd-4759-9e12-c16ce13dbb8f", "sighting_of_ref": "indicator--2bdb70b8-5be2-4f82-8ab0-1e44bf126ecc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cfea259-2a7a-4dbc-b1f0-ea19a0d41595", "sighting_of_ref": "indicator--4ed6d70e-82be-41e5-8a41-06f6aca54ed1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--478ad342-074e-4839-a5d6-0d9b2e7282e7", "sighting_of_ref": "indicator--c64e235c-1642-446f-8780-6fa04f6bbd59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4520513-5622-4023-849e-eb876acc2ad4", "sighting_of_ref": "indicator--68f8cff4-c084-4d08-a596-df004b1c7c07", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85fa22fd-84fe-4633-91aa-b9f4ce1bad59", "sighting_of_ref": "indicator--b41841c3-9885-4144-831e-3785d9221052", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163fa083-539d-4fb0-9296-31c69604f6bd", "sighting_of_ref": "indicator--bf3950c0-2aeb-4086-ab94-dd339ab24d06", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29095233-2cec-44a1-94b2-3566f7443517", "sighting_of_ref": "indicator--8c6a544d-56f1-418d-8da1-0c90af35b872", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb477d0b-2734-43de-8e52-e497805c6424", "sighting_of_ref": "indicator--ffa2823f-864d-41cb-97ed-13f60de7774d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0add2a0-9ee5-4846-9cc2-d766b1338eb2", "sighting_of_ref": "indicator--ffa2823f-864d-41cb-97ed-13f60de7774d", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--548ed4b7-5446-4b0e-a140-caa1198ae9bb", "sighting_of_ref": "indicator--78af8b9d-6862-4826-8c60-d60912e0e95a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb284633-486b-4bde-a356-32052c040ad1", "sighting_of_ref": "indicator--07717946-e12c-4375-bf5e-658615b4fa5f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a79d171d-ec08-49d1-adf2-ae78a60bdaf1", "sighting_of_ref": "indicator--5ec32dc0-9f88-4ffe-82b2-26497bd00927", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f22c8def-a9b4-41c5-bddf-54ad4632f1cb", "sighting_of_ref": "indicator--f8b3dd5d-9056-42b6-b833-b3fecef104ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e58a1bf3-1662-4786-bbb1-3f26f3a004ce", "sighting_of_ref": "indicator--aecc19f8-d618-467a-adbb-c20310dfffc8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d45123-b708-41e6-ad58-222de190c125", "sighting_of_ref": "indicator--0b156453-0361-4d3b-81b0-df893311d032", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ebd46bb-806b-4165-b1ce-79be3de0a4f4", "sighting_of_ref": "indicator--fc686875-ed08-42fc-a145-44107e776897", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aeb88e5-de1c-4771-90a5-04d329d223d9", "sighting_of_ref": "indicator--4cbd3c60-56c4-4c16-86df-bdc08a1f5b73", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dee7d5d-c954-44d6-afc9-0c0d491df686", "sighting_of_ref": "indicator--463080f1-f9cf-49fe-90f9-90001d38ebcd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f417c7b-b69d-40b2-a19c-e9e97a220b35", "sighting_of_ref": "indicator--06b35f3d-715e-4b3b-86d3-1c61a4b40c7a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16ba0441-a902-4275-9a29-c869c84f8493", "sighting_of_ref": "indicator--b2464a62-1b98-4a9a-a74e-5e5dedd81147", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--118eee36-47a2-4f4c-9794-cd0d73b54920", "sighting_of_ref": "indicator--32e0d7b9-962a-47dc-8ca9-8b27055c8100", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04f8ed3b-c625-4b0a-867c-ece014a4eac1", "sighting_of_ref": "indicator--12b3803c-8e6e-493c-86e1-d87247a5796a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8dfd672-b697-42af-865a-663de96d37ab", "sighting_of_ref": "indicator--749343a7-ef5b-4c01-81ec-7dcbea8141f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2974944-c1ed-4d8a-9984-834805fa41d3", "sighting_of_ref": "indicator--4e65bff8-8c41-44c2-9f1a-9041301beb38", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71084fbe-cb20-4615-9da9-06c13da5603c", "sighting_of_ref": "indicator--e3a722b2-21dd-415c-9d43-176749f6a497", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01d8123a-5c03-48c8-aea8-096960ef9279", "sighting_of_ref": "indicator--779c82e0-3194-4b54-b0c8-d6f2397d6dd0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a59009ed-e9d9-4796-9860-074303ab832c", "sighting_of_ref": "indicator--abcbd846-d44e-41fa-af58-26b1d53ac2ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86ff5a27-617d-43b7-814b-2466ff23e6fa", "sighting_of_ref": "indicator--8865a40d-2766-4f3a-b9e3-7de4bd8672e0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27783cc4-dfa1-4b7a-b796-fca932613a58", "sighting_of_ref": "indicator--b04ee34c-43bb-45fd-a3d2-1cee304d7f9b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7df6e169-085a-4e24-b971-5735a14cff3d", "sighting_of_ref": "indicator--b7f38595-b9c0-4b9b-ae77-9193a6475062", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13e6df80-8ef2-44b9-b2d2-c671e670ebf9", "sighting_of_ref": "indicator--1704e779-222d-4abd-8b8c-af32a06eab70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef9b09c8-a372-4a3e-85ce-86008b9d5bab", "sighting_of_ref": "indicator--9f8747aa-5d63-480b-b705-a9d4206d2a9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ea2b561-d805-4f27-952d-519b14ed0ca9", "sighting_of_ref": "indicator--9ecb4054-fb47-46c7-ad19-b46ed4ef52b0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe94abef-69b8-463b-9519-dfab280df852", "sighting_of_ref": "indicator--19edaa79-30c4-40e1-bd24-d47619930ed4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e76335a7-3e04-4d87-a238-2f637c28fe23", "sighting_of_ref": "indicator--c561d417-6aec-48c2-a2be-3ac6cdf2cf45", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4deaec07-f38f-44ca-9fd3-c25c9ab6113b", "sighting_of_ref": "indicator--0b76bed4-de67-4bcd-be96-7229df0c44a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ca5cb7-42fd-42db-b13f-28a636b9d808", "sighting_of_ref": "indicator--e2efa881-46b0-4328-b585-675b40389356", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f20dd52-19b6-4bc8-aceb-bccb1d4fcdad", "sighting_of_ref": "indicator--eec60342-d10c-4cc1-a871-17a2a0368f3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa6f4da9-32b6-4b2e-a45b-94890d47dcc1", "sighting_of_ref": "indicator--49544427-2761-4b8d-9134-0718fdedf93c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cfa1d35-1895-46c8-85d7-5bb872278512", "sighting_of_ref": "indicator--57f6f968-bb72-4f61-bd8b-34bddfc01b6f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2bd614d-bae5-4ea6-940e-d821544c6b1b", "sighting_of_ref": "indicator--321a8c02-e649-4a1b-b7d2-60d271b6eef8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5527b38c-e7d8-4645-91b0-516845df3005", "sighting_of_ref": "indicator--ec278eab-9b2c-4f74-a2ee-09eedd92815a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12bc1680-7cda-4346-92ab-8e99ae4f4a91", "sighting_of_ref": "indicator--59981371-104c-45a1-b0a5-6ff978731b0a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f80627fd-9560-4ed2-a043-6b75d69f775f", "sighting_of_ref": "indicator--4d4ba1d9-9299-4193-b6de-d96b7c8c6fef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67ba2ba4-3ecb-420b-973b-5ee80114c0c3", "sighting_of_ref": "indicator--5dd97082-1ee6-4086-9be9-a32a73debf18", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5148c7dc-b4a1-49a4-b089-ef44d0d69e2e", "sighting_of_ref": "indicator--5f576868-e117-4019-8a56-11d4c103a5e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8efc0776-80c3-4a13-afd1-628136c77bfa", "sighting_of_ref": "indicator--40835e23-eb90-48bd-9d35-850fbba181ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1baf64bc-1c93-4512-90a4-defbeb436594", "sighting_of_ref": "indicator--5c9641e3-8eee-4886-8ca4-3eb0822a0d9f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eadd375d-cb45-4e36-9a95-56fbf063e34e", "sighting_of_ref": "indicator--6f7e7b20-fa60-4a6a-9ea5-73a77ad0f436", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bb13de6-02e5-417b-afad-9893acbeb804", "sighting_of_ref": "indicator--521625ec-fbc0-474e-92ce-907974976c02", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--146995f6-dc56-4d18-958f-3c3729ae4df7", "sighting_of_ref": "indicator--019884fa-7569-4168-b25b-7a8a5a8718c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d49e9fa-a08a-4923-9f7f-4cbd5e5820e1", "sighting_of_ref": "indicator--a9ad8b1d-0db8-403b-8e7f-7ff12bdb3fdd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2efaa25b-3cdf-457f-ad64-a8afa7a5f9a5", "sighting_of_ref": "indicator--36ac1887-b51c-4cbc-b984-a20dd0234b42", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3914b22-4bdb-472a-ac20-5e16dc61091a", "sighting_of_ref": "indicator--04f97cbf-c826-4f6b-b2ab-ad919628611d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86833125-788d-48ec-a8a4-78eaa96450d5", "sighting_of_ref": "indicator--86c425c6-b4fa-4885-8dcf-ee6c7837cf52", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f483286-5166-4909-b17c-225b4508a37e", "sighting_of_ref": "indicator--6598aef6-3cb8-4281-b0e6-b5c81b960c4a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52a0e121-432a-4dbc-8c30-f585ae84933c", "sighting_of_ref": "indicator--ad5c44dc-5fe3-4654-9743-349973c0efec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30c237c1-a122-437a-a343-b96134d96484", "sighting_of_ref": "indicator--5b45b811-15fa-4bbe-8d32-a8b44fed7acf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0348c56d-3a3c-43b2-96a8-d5dc8b8e971a", "sighting_of_ref": "indicator--acb088e9-b4f2-455c-b215-ff427bfe5fa7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7607e18-3b52-47e0-aa4f-7775e7cfe351", "sighting_of_ref": "indicator--f07dd6c9-886d-4e18-9588-e8c1b7813576", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4ab4167-83d5-47eb-aa17-decd2a58b0f2", "sighting_of_ref": "indicator--27a280be-d0ad-430a-a5a5-6ba9a98f7334", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f14bd147-c2d7-458d-8431-dcb7278d5314", "sighting_of_ref": "indicator--ecd9252f-0d07-49e6-aeef-d282885fbd54", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1952dfc0-b86e-4456-a4b1-ce8aaef28418", "sighting_of_ref": "indicator--fd5d6cbe-6774-4608-b9a2-42307247653f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--858854df-f925-47f8-a7c3-3fd68003a0f6", "sighting_of_ref": "indicator--42970bd9-02d7-4d7d-8c1f-7597f2606be4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8449e1e1-91fa-4776-a2a6-e18c41857401", "sighting_of_ref": "indicator--4fc5c3b7-314d-49b2-bbab-52aba3dcdab7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c77b633a-a8b9-4392-9d61-bdc1fda1601e", "sighting_of_ref": "indicator--503f68fa-fc22-4344-a993-5627118a5a17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dea7def3-772b-4868-bcbf-efa02ea060d6", "sighting_of_ref": "indicator--dbc8792d-64ce-4ba5-8a11-bf19c9d69505", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc04c450-8ee9-4300-b88e-ab53c390a8bc", "sighting_of_ref": "indicator--ec72973a-fe29-4d6e-853a-8e509005bc66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb0f9c64-5b8f-41c3-a56a-bf6dd30f1128", "sighting_of_ref": "indicator--45c8a819-a177-4db8-acbe-63495346fa34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a005d6f-70a6-48cd-863f-8225367e7703", "sighting_of_ref": "indicator--84d707f0-344a-40fb-8116-19b6fa3834d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e4b5cac-72fc-4319-b2bf-d84304035fcc", "sighting_of_ref": "indicator--f30f9ca3-c0ab-4418-92ef-8bb05e7e0e95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--572da80b-d2f0-4d98-bb1c-fa30372dd04c", "sighting_of_ref": "indicator--b565a3ef-f17e-4a67-ae45-a55735b7f069", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0fdf797-106a-46db-baff-702060f64fbd", "sighting_of_ref": "indicator--e446f2cc-edf4-4cab-9100-a80787434ea7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2abbe61-b4a0-4837-ae21-19ce793db6da", "sighting_of_ref": "indicator--34b1c849-5e6f-4dff-bfe4-7ec023dfaf50", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7370bd27-ae65-4d5b-909a-aa759f5f65ef", "sighting_of_ref": "indicator--393f1bea-998a-4110-8fb5-4b2a8f078c69", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c4f0bdf-d855-4223-aa82-b028f3a07bf5", "sighting_of_ref": "indicator--649aa5e7-0cc2-49bd-a388-020d689e2443", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f30c980d-f876-4fa4-9b1a-1062fcd30ce1", "sighting_of_ref": "indicator--d99f490b-c516-4bc8-be94-12cf11d32381", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2018f2ac-d72e-421a-a8e9-2babff82bdca", "sighting_of_ref": "indicator--ad45235d-664b-4fe9-84d7-ff5d6c7868a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30251130-8bcc-4db9-887e-8a9b7c73eb50", "sighting_of_ref": "indicator--af8b9bb5-679d-4961-89c0-b2e2b5dcebc9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--020e9a42-46ca-4c18-a89e-4e1c12e9d074", "sighting_of_ref": "indicator--2e0addc2-2124-4d30-9e46-b12b32e32831", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5afd81d-f000-4bf9-a9e9-87e247fdfe79", "sighting_of_ref": "indicator--548c48c4-d12a-4815-9d98-0f6461e5205f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f42d57bd-b5ed-47ed-a70f-9f15f9b3d6be", "sighting_of_ref": "indicator--3d68cc52-65e4-4de3-a5af-45ba1f47767f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d2e9e5-6370-4577-85c4-09b8a450ce37", "sighting_of_ref": "indicator--3d26395a-4ab8-44fa-975e-ed3dd8bcb0f2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--574eabc3-c8de-4db7-acff-0f73a20c324f", "sighting_of_ref": "indicator--a3bfbbcd-df42-4045-a3f9-e0881ea4ad4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3b2b20d-5bfc-4926-ba7b-418d966a2f08", "sighting_of_ref": "indicator--7156dfaf-7ceb-411b-a635-44545b37f945", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f9cde68-1bd3-4235-ba0b-21af2a44eef2", "sighting_of_ref": "indicator--cc3d2e81-c645-492c-9f20-6c64aff7a202", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86609db0-fad7-4952-b6d7-b2c9b57bb45b", "sighting_of_ref": "indicator--658de206-377b-430c-a004-3cdc1a1ceb33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--716e8eae-362b-477a-babb-3977eb7c3a90", "sighting_of_ref": "indicator--f4ac276a-e020-478a-a06d-170306e69f59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d579ef-e4d3-421f-953d-b70cadbe4fed", "sighting_of_ref": "indicator--5e669061-21f4-4a23-ad3d-213bb1a9acef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b69b6e8-d4d4-4ecf-af46-2b0403228e08", "sighting_of_ref": "indicator--ca1c326f-d65a-4953-b798-0b6b4406f033", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64a034b8-b79f-4531-be19-52923f8d423f", "sighting_of_ref": "indicator--90c2a48e-16b7-4015-8c49-2e26b546f3e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21b6323b-e5d4-4884-b475-c45e6def4aad", "sighting_of_ref": "indicator--9d9d7247-bf8f-492c-a433-13c014ab2017", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58c8044f-f1c3-48c1-805b-aecf1d24243f", "sighting_of_ref": "indicator--b8691e6a-2c9d-42fb-97ac-fd4c65804b1d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ae41ed4-6e65-43f6-b863-dcddaa374d10", "sighting_of_ref": "indicator--4beac2a4-2bbd-4ff4-86a4-5b43e52e0050", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70084c5b-49b8-44a5-b706-a22fa8ee5992", "sighting_of_ref": "indicator--b14dd018-f440-4649-9c5d-30e743422b38", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1598c15-19a3-4503-8586-e5cad6a64e60", "sighting_of_ref": "indicator--d432f13b-9ed1-49cc-8cd7-bdf76518f340", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7190f269-9ef8-454d-a59c-40926a405efd", "sighting_of_ref": "indicator--8e9df4ec-71f7-4aa4-89c9-f04876d4d43e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ab707aa-ea7f-4646-8f06-8d8b44fe10b8", "sighting_of_ref": "indicator--4322baea-ad13-4d63-826f-79e0e3333be1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b60413df-9889-4271-93e6-d8116845016e", "sighting_of_ref": "indicator--04de3c7c-7b81-40fb-bee0-d7d6a3760086", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e234f27c-0b9e-49d1-9b32-3035b19f9a48", "sighting_of_ref": "indicator--85faa33f-5dfe-46ad-91e0-6f3800a93bbd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea1b594-1663-45dc-a516-fef5af639195", "sighting_of_ref": "indicator--59f314dd-3aed-47fc-a22d-46a9d9b1f37d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaa61ba6-f354-42d7-82a7-befe8b56cade", "sighting_of_ref": "indicator--2dfc3136-0e6e-438e-88d1-0b27543dc075", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dabcdd7d-4e3b-49b4-85e2-846161451d26", "sighting_of_ref": "indicator--3d724020-1ce6-4609-b152-3a660661fdf9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30a6c5ba-51d6-41c1-827f-9a25c1d06103", "sighting_of_ref": "indicator--86db9c10-c809-4534-8c2f-928ca3b8ee11", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edf1a3f9-854a-45e0-b348-693afef2d93d", "sighting_of_ref": "indicator--1e3b6837-a344-4fb5-b07e-1256334ddf41", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6866a5dc-7569-4824-88fb-f94f67fcd140", "sighting_of_ref": "indicator--35479cd4-52d8-4727-a3a8-b71e67b8d425", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07c0de33-7b4f-49ac-b797-5350f271baa8", "sighting_of_ref": "indicator--4492bbed-450c-4feb-84b8-7ca99f993791", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0e70eba-91e8-4428-a771-20ba6a923391", "sighting_of_ref": "indicator--a78c8ef8-79ac-43f9-b0b4-a1315d36c4ee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaf750ff-021c-4f51-be15-52f3bb4d3137", "sighting_of_ref": "indicator--2586e781-d09d-4b52-be74-41197e0a45fb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aaa5cb4-beb6-4767-b7e5-6f25de4bd1d9", "sighting_of_ref": "indicator--7e23a4a5-5495-4969-98d0-408bd4d0ad17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86515003-a686-41f1-89b9-34fd5d233321", "sighting_of_ref": "indicator--775c1e4f-41ff-4d38-a65d-8631fdbf03aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4799da9f-0b21-4ee1-9607-ead5944221eb", "sighting_of_ref": "indicator--6cb7a261-b7a1-4d0c-a487-43e81c8dc765", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55d48afe-973a-4889-b04f-b841879fdfb5", "sighting_of_ref": "indicator--3ff141a3-889f-4300-ab85-42867a099f0b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88913a5e-6a0a-41ac-8c3f-d6e09e325de4", "sighting_of_ref": "indicator--8421c6af-3dfb-46ed-a39e-8a60c04d9598", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6621677f-1e78-438b-9e59-6f904b737357", "sighting_of_ref": "indicator--5dfc25d5-f415-4657-b7ed-dc3a3896ca3a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0070d6b7-33bf-4458-b5a2-427c5dbac1b0", "sighting_of_ref": "indicator--57c45d4d-ca5e-4a0a-96d2-bebc4f70daa8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9865e32f-6667-4bc8-9a62-c4e4dee97e83", "sighting_of_ref": "indicator--1b98da7c-12b2-4c32-a93a-df1a278e8f57", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1675a175-98b9-4596-ab68-fb0822fe396a", "sighting_of_ref": "indicator--2a8da619-dfd3-4ff0-826c-4999e5f85bd7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e86bba30-2952-41fd-b5ee-1d104fc4e40b", "sighting_of_ref": "indicator--2b7cc23b-a533-47c7-bce2-147da82e917a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3733d3d6-1582-4ef5-846c-744c434a3a99", "sighting_of_ref": "indicator--2301066f-75fc-43d4-8c72-3f97367c8b83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--599c499a-5d6f-4d2f-a4c8-8f4990d2a5ff", "sighting_of_ref": "indicator--95a2e9de-7585-4c26-a385-02a9e05e9e65", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ac851c5-7d68-4b85-9d27-444268478644", "sighting_of_ref": "indicator--79777d2d-f4e7-4db2-addd-4a73a3b8889b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d53faaa-4819-4082-b9b1-6ea335b52842", "sighting_of_ref": "indicator--25e5ae26-c59f-470a-a5b5-f39b30d84ca1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--957adb03-36ca-432b-ae46-bc5155f9abc5", "sighting_of_ref": "indicator--f4be2f2e-9bf8-4ae1-bcf3-3e3ba2a84a57", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8448db14-e3cc-4b7e-b404-a4ddd7617f45", "sighting_of_ref": "indicator--7822d9ca-7f86-41cc-b403-32e4b33df29c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5053a983-5143-4809-bae8-a846f0909eb7", "sighting_of_ref": "indicator--69db0f42-3401-49ef-a0fc-85ce668c88aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49c25a2e-f13a-426f-b1b9-cefa0f0fe400", "sighting_of_ref": "indicator--929b7447-1c4d-458b-9926-0a9f1a40e931", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f001a0c6-a629-460d-afa0-3e59bf341519", "sighting_of_ref": "indicator--c93f17c1-5e78-4d58-818d-3e42dd9c8c58", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8d885fd-0518-4f85-9324-e19c52bb7e0c", "sighting_of_ref": "indicator--75767092-e23e-4968-8124-4ec97789c9b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb24a57-6898-497f-a600-1e7de7f081e0", "sighting_of_ref": "indicator--0c2da1d2-aa6e-47bc-a027-56263f42d47c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d382edb7-9869-4e09-adae-301c6e90b959", "sighting_of_ref": "indicator--c2af883b-1106-404a-88fd-9563f108eef7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04b5be44-25b4-4a10-b70d-26d9c518e307", "sighting_of_ref": "indicator--c35b6625-3846-4c79-8cbb-4af9a2fa9590", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fd21714-42ef-4bf9-94cf-ba76eee167ee", "sighting_of_ref": "indicator--29d4f281-d64a-41a3-97d9-f60e3c2aa457", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07d5ddc5-0d97-43d4-bfad-58563d28fbec", "sighting_of_ref": "indicator--589eaa21-05e2-4eb8-b326-76ec7b6ce6d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4852bf10-7ab3-404b-91a4-eea989eaef3c", "sighting_of_ref": "indicator--7f512a55-b45f-43a5-996e-62de01596d2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb81be47-8a75-4239-bb92-05725c70bd10", "sighting_of_ref": "indicator--6bcef634-e6fd-4ad1-9f58-9d69eed96370", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afb8cff5-4b53-4d71-97b6-3e5392e936f3", "sighting_of_ref": "indicator--8235eedf-895b-48b4-947d-f3452a7241c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bba048e3-1185-4720-a553-cc889e0bacdd", "sighting_of_ref": "indicator--aa556c4b-938a-461c-a7dc-db29c55dbd5c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--607fae0f-2b2e-4f2e-87bb-dcd31206109e", "sighting_of_ref": "indicator--9ee8261a-3b8a-4591-bef7-337c633354bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24110068-fb87-422c-b634-c214a2eccd0f", "sighting_of_ref": "indicator--e54b7cea-421e-4d90-90c1-99e75842833a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d599b3c4-b871-4266-a346-6c997461bebe", "sighting_of_ref": "indicator--e62882ec-bbdd-4388-87bc-d013b86bd727", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64ce7d4f-3089-49e1-be5d-16b0a074e014", "sighting_of_ref": "indicator--4d630f76-f083-40b8-a775-c8333d1dcaac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b36b8ee6-cc99-44c5-b301-f00b56bf353f", "sighting_of_ref": "indicator--2ca840eb-139f-42d6-b20c-d9ebadcc3c95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab4cec0b-0b0a-47e9-bfe3-e569979a6fca", "sighting_of_ref": "indicator--e501ba3d-9426-4173-a42e-79251894bc8c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a183378-9dc5-49cf-885f-065f955250de", "sighting_of_ref": "indicator--87e9345a-ccd6-4579-8f12-de1f79884299", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27f418a4-6875-491b-815d-7cc9dfc9f707", "sighting_of_ref": "indicator--b912a984-9ac4-4257-ba76-58bc351e95ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7183a263-403b-494a-940c-42d0bf8248cc", "sighting_of_ref": "indicator--b527043a-41ca-42ce-be8a-ee0646efbdaf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44f766df-4fd6-45df-a9a1-fd92633dcedf", "sighting_of_ref": "indicator--2fb1cbbe-ada8-493d-a042-7daa006fe51b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31a5f799-1716-4480-93cc-f19041d091bf", "sighting_of_ref": "indicator--29d8b4c3-4fef-43a6-af55-b279c29fdc76", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4beba207-f248-4874-809d-46dde77508d1", "sighting_of_ref": "indicator--084bddcf-6fab-4c88-820c-48b92f5f1a8f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b04ae54-4d49-48a6-b9b7-75b377dbb53c", "sighting_of_ref": "indicator--afdbeca8-7577-464f-a770-a711f04a66a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45905710-9114-4de7-bb17-3171ff6fa87a", "sighting_of_ref": "indicator--e166ee88-f715-4b8f-9352-99783b01f073", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7599a765-28b8-476b-a55c-bb7cc79e9a4a", "sighting_of_ref": "indicator--e1ccf872-d2f1-4e3c-bb17-5c0b3da89000", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1438cf50-a6e8-4b94-99e1-cbf646a26a17", "sighting_of_ref": "indicator--ebe35768-3490-4a9f-827c-cda53a5b6d66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--855275d1-a138-4a2c-8d1b-4337b3a8ecaa", "sighting_of_ref": "indicator--27592e73-1bef-4216-9b8c-7724f7e87537", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b12c59b0-7491-4899-8898-a99d979ac224", "sighting_of_ref": "indicator--85cde4a9-fedb-474a-93dc-33bdedee0f92", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53b165be-08e6-4072-b817-9ff0bb4ecff9", "sighting_of_ref": "indicator--e6946bd2-734d-412a-b638-32a1130427f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a9df68-2642-47e2-9ef3-e7d8d83b1a23", "sighting_of_ref": "indicator--614d69ca-582c-42f7-8a0f-55aad0bce651", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--761911a2-586d-42d1-bb43-9998e48fb3a8", "sighting_of_ref": "indicator--0a2c0b16-3d4e-430a-b2ee-7604b0ef3fd1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f91e4c-b5ca-4570-8676-a0887298c413", "sighting_of_ref": "indicator--87395e56-9e0d-42c4-9f20-a2a701bb2a14", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f137ed3f-a5f3-46de-8e02-016a41210c1a", "sighting_of_ref": "indicator--1e46c046-7263-4674-b446-fac58f471365", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8845742e-0eb7-407c-9609-870f4ec421a2", "sighting_of_ref": "indicator--9a4a2335-5809-4080-95b6-ee2c67ae78da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c06fb943-8fca-44b7-a312-08e1a85ef321", "sighting_of_ref": "indicator--95434279-d5b5-41cd-9cef-e64c7af726f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e354a368-f246-4a7e-958a-65c33e16654e", "sighting_of_ref": "indicator--c683637c-78a1-4816-a03e-59f2430b0e9a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df2e2df8-59f9-4fb0-b259-1df1e94f5340", "sighting_of_ref": "indicator--ef258e72-07fb-4792-a925-e5e87ec9be68", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f6d5b46-4523-4c2d-992a-be25ef7a133e", "sighting_of_ref": "indicator--eacb36d4-dee2-4e07-b567-cfbbabdee203", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e124431-5bc8-4d91-82c0-f089f06f33e7", "sighting_of_ref": "indicator--4fee434b-6c56-43c3-9531-9de513d179d6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6220ad07-2acd-4138-b878-0b09d12c9a65", "sighting_of_ref": "indicator--4c41ee4b-c2d0-4df8-ad8e-7c31fb3e5f3a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcd71ddb-0616-462d-880e-95f4b622f3e9", "sighting_of_ref": "indicator--774ea8b0-28a7-4405-aa67-2543439e5015", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc4faed1-14c3-4ce2-97f3-aea547cfa9f2", "sighting_of_ref": "indicator--b6050741-df20-40cc-95c8-d5a17adffaf0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37f470a1-0ef3-45fd-bb91-76d63aaa5086", "sighting_of_ref": "indicator--635745ad-b589-4cfe-bf96-7f3058486cad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df37701e-b6b3-4045-83d1-53c07889e3c9", "sighting_of_ref": "indicator--d604a906-578b-43e6-9df2-e9b98f26710f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f72f272-6c16-4419-88d8-48605c4447ab", "sighting_of_ref": "indicator--d6cf0f65-afa3-4387-8f0d-8213f839000f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da7000bb-1cf7-4a21-a271-8f309ffde206", "sighting_of_ref": "indicator--4859964c-b900-4688-8771-d1fb1e09f940", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5deae15-93a8-4c24-b63b-5c2b7eaac740", "sighting_of_ref": "indicator--ada3d651-f6b0-4939-a507-93f01bb4789b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d9b242b-1e3d-4d9c-b2e7-bccb6803471a", "sighting_of_ref": "indicator--820ae2b6-46aa-4a67-a645-dcee7434ae90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5cd4910-ac0b-4dca-b2b0-6dacca89d8dd", "sighting_of_ref": "indicator--b4c9beaf-e3b4-4a1a-b5de-2d2819c33caa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e9f2ca4-dadc-4a7b-b663-b059c7cd5446", "sighting_of_ref": "indicator--83baed44-0b45-4dbb-b647-3552f12a89cf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0e43b01-fa27-41f7-b10c-3514cb2bcdca", "sighting_of_ref": "indicator--dfae7990-a5a3-4188-99dc-e82b9fb5ccce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02f83327-f8b2-43a1-bd6d-fd09d5a06e00", "sighting_of_ref": "indicator--aab89919-e87a-4710-bc3f-aa318c3fd990", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a35f93b-414c-464d-bb24-f3d740a59ac1", "sighting_of_ref": "indicator--88760db6-aeba-4958-9655-6d68da887b7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db75d921-faeb-4d0b-b3d5-4655c1ceaffd", "sighting_of_ref": "indicator--0ca337e9-4820-460e-88a1-6d0c26090820", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7616c094-b6aa-414b-b795-bd27b28d1c08", "sighting_of_ref": "indicator--52086a87-30b3-457e-9d33-253f5b9dcf10", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6e7561f-76ae-49e4-8d7c-d126fe9f4390", "sighting_of_ref": "indicator--23e6e2b3-71a6-4fb9-9613-3b6b1c266fa3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37a28c1b-8c29-4397-8534-124689a055f6", "sighting_of_ref": "indicator--1772269f-b205-48e2-ac91-71051fb11497", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10de4a27-4f1a-40de-b47a-d40962611ba2", "sighting_of_ref": "indicator--f2c78012-a968-471f-8a0e-af950df1af95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fde53ff6-e77c-4c42-b0ea-bd92cbe49c57", "sighting_of_ref": "indicator--1707c4a5-e55d-44f9-ab90-5f4bbe238ae0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb6ec049-94bf-421d-b8bd-e4c0c6ec53e5", "sighting_of_ref": "indicator--bca466c9-1226-4f91-b158-b536b101a170", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ddd3af-6dd7-4bd5-a472-65a444f58100", "sighting_of_ref": "indicator--87171159-ecbd-439b-9159-01bf55ff5009", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79858ab3-df8c-46be-8e78-fd9e03f18171", "sighting_of_ref": "indicator--a9726d84-e59a-4887-bfd8-f1ed50623212", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9423257-7994-4f6c-a724-248fb9428587", "sighting_of_ref": "indicator--3d3dddfe-0669-4771-8d54-aa725f824266", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1e94217-9dc3-4e86-be47-e9e1cce0f8f6", "sighting_of_ref": "indicator--24e836f1-b7cc-4425-86b0-4721120c49d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfeed412-dc07-4361-b62a-b6ffeec22490", "sighting_of_ref": "indicator--f8a7b01b-93c5-4128-ae62-35dd365c517c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--070afa78-9db4-4548-baf5-e075d4a82bbd", "sighting_of_ref": "indicator--a58c9bf3-277a-4c98-bb09-27bdf51b3e17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0a1b596-9f90-451a-af4e-b79c992f617a", "sighting_of_ref": "indicator--cd95b695-f3a9-47eb-a2ba-49265f96ce24", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfc5f5da-b4d0-4a51-8f39-044fd7395e61", "sighting_of_ref": "indicator--82c1c906-2d42-4ec0-987a-17a1366cba80", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29baee3a-950a-4b9c-86b5-2b94c487039c", "sighting_of_ref": "indicator--ee7632aa-0aea-409c-8603-01e8b24361a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f4ff5a1-b682-4a8a-9235-0d92605c946b", "sighting_of_ref": "indicator--963b91d7-4e7c-4150-a05a-01776539c8a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a3ec3ca-b15a-4946-8138-e2917828f62c", "sighting_of_ref": "indicator--6c158a67-461f-41ab-a3df-9b785b5b9e40", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c453b35-40ef-4b00-b4dd-dcb1f5770966", "sighting_of_ref": "indicator--dbbc6385-84ec-490e-afc1-0141e28bca31", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b01d520-516d-486f-bc85-6f0e62eb791a", "sighting_of_ref": "indicator--e8246c98-39ef-4ec8-bbaa-d4e80db6bc90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71a6cace-b2f6-4a07-9094-d7d06ac0ccdc", "sighting_of_ref": "indicator--9a360aa2-5bf4-4577-93bc-9d3218238486", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f678f228-7e33-43e2-819a-ade2c850923c", "sighting_of_ref": "indicator--c0b86c53-205a-49c3-a291-0961ab5a929a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bde65d9-59d9-4bc7-a62d-1ca58738b3ed", "sighting_of_ref": "indicator--06d580f5-53fe-493a-9fb3-cd6ab73e06d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c61b1418-ee4f-456b-8e28-b8fe26c5c294", "sighting_of_ref": "indicator--6a8b96eb-1a7b-4187-ab39-09ccaa998c99", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8181888-681a-49e0-906e-b48a31d338da", "sighting_of_ref": "indicator--2b34a88b-4d47-42c7-a35c-7ca571ca0d51", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c53c387-65ed-4d80-a573-b48ceb6986cc", "sighting_of_ref": "indicator--7ecc62ba-fc7a-4645-9dfb-323c3a72d189", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2bd6412-f96a-4ad2-a0ab-e00a6e060005", "sighting_of_ref": "indicator--872459f3-4126-44a3-8a9c-a66fce48d381", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7dfeed0-6ae0-4738-9b16-966c2086b6a8", "sighting_of_ref": "indicator--bb4e73c7-329d-4708-be3b-47163f761b01", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6796ccb3-ed4d-4297-99a5-ebbb1179f8ab", "sighting_of_ref": "indicator--fdddcc90-0bb2-49d6-8bca-2290811cc019", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0df4dbd1-50c5-4484-8623-7debe1e1d20a", "sighting_of_ref": "indicator--f074da32-9858-47ac-9cb5-6a1bbc515433", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68bf1d01-453a-4d93-84f8-e1a5e28fcbc3", "sighting_of_ref": "indicator--bb39f82d-bd88-4bdf-b575-277e194d8134", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ce7a448-8804-45cd-a518-fbfcdfdaee71", "sighting_of_ref": "indicator--d860fcf3-7037-41ec-8ccc-f2b65c8d1f69", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc9d31ec-fd8b-4ab6-864a-5af153ee1d5e", "sighting_of_ref": "indicator--6c8c0fd7-fa2f-414d-b0ff-e27d869b47d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25695870-2d3f-4a8b-8379-cbe865593b21", "sighting_of_ref": "indicator--7cadbb16-2e15-486d-b1d1-44ee1072f831", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d1e759-097c-4be7-b0b4-02738875f93e", "sighting_of_ref": "indicator--a3a2c853-73de-41e8-a654-89992aba51cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb78272a-5e67-40db-8e89-c5201a985e19", "sighting_of_ref": "indicator--b659ee31-7b5b-4d36-983c-342ddde68448", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1f037d8-54fe-43e7-b582-08d796b7f6d2", "sighting_of_ref": "indicator--ffed2da5-6fdb-49f3-ab0f-31ad751def2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21ad74e4-7db8-4400-a936-266a18ede816", "sighting_of_ref": "indicator--22adc4aa-dfc0-495e-925c-ac740d888396", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e875a1-80a2-4016-85b2-5e5f024394ef", "sighting_of_ref": "indicator--c0fc5cb6-88ce-49ff-b83d-b6eb1b6e0d25", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aaf3ff9-d6de-463c-8ea9-1fa5dd26eed8", "sighting_of_ref": "indicator--eb33831d-0c09-4bf9-a679-de4f13ed07d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3675a67f-8409-407c-a78a-ca7f8c5fc5e1", "sighting_of_ref": "indicator--4bc46726-d8ab-4714-bbca-53e1235ec22b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ef53281-34ef-4829-a5b8-6630a51b0dce", "sighting_of_ref": "indicator--80bf1c30-c070-4bcd-8f7c-1d8b7e39087b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a775e50-1bc3-4eaf-abd5-8251242bb031", "sighting_of_ref": "indicator--77fb42fe-0ae4-4e20-ad83-0adff41fb808", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c902d03-8381-4c7a-8b44-ef8937cb2884", "sighting_of_ref": "indicator--bb2383ba-e690-4be3-aa16-3b7aabe866b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd21e7a5-6c0a-48e5-94dd-5415113f4b98", "sighting_of_ref": "indicator--90de35aa-0630-442e-9e04-9657498b5859", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f43f276-e04e-432c-b21a-5803298d1960", "sighting_of_ref": "indicator--675cd72b-a975-4694-bd01-e150d7e0c0fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcd4f232-c633-44fe-91ef-8769273f45f0", "sighting_of_ref": "indicator--57a64b1e-1340-4869-a554-cdde3136199d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67f7abae-3109-459f-944e-9a254d289f0b", "sighting_of_ref": "indicator--8f191e35-2379-4cd0-8a92-3480123b6e71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--970c6447-f227-4c7a-86a4-1c13586c8234", "sighting_of_ref": "indicator--2ea2328b-a20b-4261-8b76-769efb3d0814", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40884435-7b37-4513-8f8d-9fd9fe9ff1dc", "sighting_of_ref": "indicator--0082a7e9-0153-4a2d-b161-dce1f3eb85fe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cae905f6-360a-40b3-a149-088299606586", "sighting_of_ref": "indicator--225480a8-0d61-45c9-89b0-dcffdeeb9b67", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcfd0d46-04f8-4945-adde-e738838612d0", "sighting_of_ref": "indicator--6d70be00-f169-4575-9263-f18ca9764f3a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--986b1938-38d1-419a-a094-ac0ccb3c8bb4", "sighting_of_ref": "indicator--ca795f60-d065-4336-88ea-7b2aa1b4f185", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e0a1120-cfe0-455f-b71e-668e7d4e8c09", "sighting_of_ref": "indicator--6ef9402e-28dd-4450-aaea-57f66e00ede0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d841ae30-fd65-4642-8db3-33b2cac6c321", "sighting_of_ref": "indicator--87ad2c72-fa42-471e-866c-52f313cff258", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fafd3055-eb72-4295-96b8-3753863457a1", "sighting_of_ref": "indicator--ebd111d9-f5eb-4d1a-a0c6-886e94c92ba5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dedda028-19d7-4bf5-9a14-063b068082e9", "sighting_of_ref": "indicator--9812a8d6-9342-4e86-a14f-b76a3f336510", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6473df4-a13a-4f1f-88a9-6dd852df9b5a", "sighting_of_ref": "indicator--9701cfab-ffd0-4a02-bfa8-bcb0fd691333", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84e3914e-bb1f-4ee1-b4bc-72a1fb85c080", "sighting_of_ref": "indicator--147c7d5c-c9dc-4eb5-8fe0-34652794e51b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08d408d1-9b24-4bf5-9a3d-ab4e0df2d6d1", "sighting_of_ref": "indicator--e34fa316-45a4-486a-8c8e-f222b8b99657", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e1a6edd-18e7-46a8-a353-b082984c7a16", "sighting_of_ref": "indicator--938bd0bd-9979-42f7-9497-00a6b325d992", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e649d19-7b0b-4ede-8547-b75833a9f387", "sighting_of_ref": "indicator--ccc095de-94d3-4999-8799-61858886522d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91800014-7582-466f-ad0a-bd601ee01c8e", "sighting_of_ref": "indicator--3428d6d4-dfab-4aab-b374-e21613e48335", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c29196e-1024-4f3e-ae26-93083aa077ca", "sighting_of_ref": "indicator--a89d9d03-74ae-48d4-98a5-1ebbae6c6ea2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98195801-3550-4b9d-8d3c-c1b5ccf57e0d", "sighting_of_ref": "indicator--e2ac6b38-802b-4426-b563-30427c03b28f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bc570b5-c8af-404f-b3d5-2daf56f6e26e", "sighting_of_ref": "indicator--2ccb1377-dd1c-4225-9f61-658e19e987d2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1e7a33a-d838-468c-bbad-66a51567f2ec", "sighting_of_ref": "indicator--0ba70e57-e102-4a99-9c49-e45c9d7eeaa1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e0ac474-0854-404d-91da-6656ef2ad086", "sighting_of_ref": "indicator--c3d759e2-93dd-4c59-99db-ebcbe58ac36e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbb76d2e-1ed1-4d2b-8ad1-4d7dccaa77e4", "sighting_of_ref": "indicator--48da8a02-7cab-4e51-8aa0-e3e213d3c45f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c353ce6d-b7c6-4d95-8383-5f312b0a9ff2", "sighting_of_ref": "indicator--c8f28b72-ec92-40cf-8cd1-e720a3e989ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd6eee82-9d79-4358-b0b6-ff7de47e9835", "sighting_of_ref": "indicator--646ef146-eb94-4320-830a-9c8ee5636eb9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba17d4d0-bc8f-4b99-abbb-a176540df5d6", "sighting_of_ref": "indicator--5b0a4e12-e29b-48e6-9549-0fedf908d62b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93f3d41a-f9a0-4060-a42b-eea2f13ac189", "sighting_of_ref": "indicator--c60560ce-428b-49db-8c5f-9d5ce1190372", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e44f160b-80bb-457b-981b-870ef5987d20", "sighting_of_ref": "indicator--598b0a46-da89-401a-8899-488f6e7be36e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51bfdd0c-2722-4501-a4e8-a4f5652c7439", "sighting_of_ref": "indicator--d5a50b3e-6bff-4e05-b175-79ae2d775720", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f04b28e-187c-40fd-9599-b13f4ce29cb7", "sighting_of_ref": "indicator--e66d52f2-f9f2-4a61-9f21-3b5bab670780", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b707523-7dd6-4fd2-83ce-9b37bc91e862", "sighting_of_ref": "indicator--cd8c1f69-86b6-4b86-b30d-39eba3f71452", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a19d3032-b2b3-4f4d-a04b-5a101778451d", "sighting_of_ref": "indicator--c82c9dd3-04a6-4a0b-a309-bc8531085cf8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9147edc0-b033-47ad-b286-84af602bd7ae", "sighting_of_ref": "indicator--b669eacc-825c-4179-8179-9f4579218eb2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c37cfdca-29ab-49b2-94ea-636faa017b26", "sighting_of_ref": "indicator--449d5557-ace1-415e-ab64-7424752bcb56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9b7786a-140d-4664-89d8-2fbd264db9ee", "sighting_of_ref": "indicator--ec417707-82c2-453b-93ce-48cc442be74b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf083b6f-c5b5-4b84-bf45-790763a81512", "sighting_of_ref": "indicator--137ecc85-b248-4123-a56a-c85872dab76b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd752362-f477-4544-9ad9-abfa55cdbfb3", "sighting_of_ref": "indicator--dec6c0d5-ae44-4104-bc58-3442f809ec4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62bdea5c-005d-4c93-af6d-79d185b17902", "sighting_of_ref": "indicator--cb069794-cf4a-4cbb-9ed5-d6080e9b9bc7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9558d7d5-c22a-4454-aeba-b9fb2811cbce", "sighting_of_ref": "indicator--5512c00b-32d6-477d-a430-51356363d525", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e1609b-5538-4cce-b21e-48eddf649d52", "sighting_of_ref": "indicator--cfb8a1d2-2ab3-487b-99d7-6e4927278f13", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e093e53b-d6bf-4711-87be-5d63b82bbcec", "sighting_of_ref": "indicator--05d70252-46c4-4cc8-b26a-5e7bdc29768d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--befdf5ce-9e35-453c-86f6-2ee426969ad9", "sighting_of_ref": "indicator--44938098-e9ce-41e7-b7fd-710feedfb1f0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2702fa9-f6c4-491e-83da-86b753b3b60f", "sighting_of_ref": "indicator--2e1b2f32-db6a-47a2-9031-a01b211482e8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--125fd79a-26d6-439b-bf66-d7be09657faa", "sighting_of_ref": "indicator--667a6f6c-448d-4917-bd85-d524b2970fa7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17fc5611-4188-4b1a-89e5-3f29839635e9", "sighting_of_ref": "indicator--ee480c64-0bf0-4409-8eca-f4db7b3907e0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--391e33f5-b6cb-449d-b975-6693a54484cc", "sighting_of_ref": "indicator--30177fd3-25cd-438b-b2c7-4ce580ea1e6b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b3f830b-ea2c-43d5-b656-28695fd4a720", "sighting_of_ref": "indicator--1d6e8bda-8c98-452f-9207-858acd738387", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c4d6a9-d04b-4f10-83cd-4dc324257658", "sighting_of_ref": "indicator--653d8ce8-049f-4a19-ab27-5772e48e334a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dcae9ff-52f0-42e7-baef-9d329ac75bb6", "sighting_of_ref": "indicator--6b7b1f1c-bea8-4259-a3bd-b948aa8c22e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7916cac4-e70b-4d37-9cb4-d0b6b9ecd2e1", "sighting_of_ref": "indicator--0f2be817-04ad-4dfa-aad1-9f471b5b2c9a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30cc32f1-6c20-489f-b710-d0cb12d817c5", "sighting_of_ref": "indicator--10f30546-4675-4d9a-9d26-0c5776f4ef9b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90349ddd-8df1-411a-94fc-80f7c1a34927", "sighting_of_ref": "indicator--102d72da-914d-4f02-b90f-3c3c3997078d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caff0159-e528-47be-bf6f-a8243124301c", "sighting_of_ref": "indicator--b95eb76e-0773-4b4f-8e2e-afae2b45f7c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f80ef09-8ec5-4314-af0c-b2d636d3fcca", "sighting_of_ref": "indicator--be6bf779-a6b5-4c8e-be2c-03455bd6aa46", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--463aa21f-8053-4188-8667-0263920ecc84", "sighting_of_ref": "indicator--ff0e1944-aa4e-4d92-985b-890b27fe9b30", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdcdcc15-88d6-4675-8659-a75bf0a72f3f", "sighting_of_ref": "indicator--cf600e74-9fb8-4871-af34-7c456931869a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1e00fe4-f141-47cf-a6cb-59e77b99357a", "sighting_of_ref": "indicator--80512d55-e587-42cf-a49e-d75301cf6a5d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--447f1f13-6240-4d01-8a68-c7b5c68fcd65", "sighting_of_ref": "indicator--963f93e9-119e-4909-b6dd-b7e7309673d3", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5995a30e-9716-4449-9226-fe29ee8586b2", "sighting_of_ref": "indicator--355a9a0b-5053-41b9-97be-916e54511bdf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ea3c524-45c0-4f95-a039-d83dfbaaf1e4", "sighting_of_ref": "indicator--fcb45c2b-ed26-4a7e-9da4-25831a957e27", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--877cd6b9-ceb0-40c0-904d-9059c4b9a1ab", "sighting_of_ref": "indicator--263947d7-7321-49d8-9417-2f25a1fe4893", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bc7d429-6d2e-4718-a597-0d9017920446", "sighting_of_ref": "indicator--b47c3927-c78a-4334-bb84-a5cf067ecea2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56f369b2-a67a-4926-b9ff-75fd1add3760", "sighting_of_ref": "indicator--21510c93-f741-4ec9-bbd9-6799761bbac2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e157069c-29b1-43d0-9f05-e8476d7a310a", "sighting_of_ref": "indicator--c53bd1d5-d310-4e4f-9625-432d4bdc3c9a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e581594-ecb6-412b-a779-5f4c20ea2e1a", "sighting_of_ref": "indicator--cea2ee1a-fde0-43c0-8362-9cfeaae205a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--875fc05a-d644-4661-9a7a-aafdf6b92947", "sighting_of_ref": "indicator--861a3099-b81a-4874-8efd-24406cf22407", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2da03b68-e77a-42ba-a2f6-3e71abe7b63b", "sighting_of_ref": "indicator--010b4da7-3de3-41a0-bf45-2001d46f324e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--248e9c17-81b8-45c0-932e-08b8ed163947", "sighting_of_ref": "indicator--cb3399a4-d8e9-4fe8-9b03-2a47021e3631", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c3912d8-6fd7-48d1-bf5d-110278068ff4", "sighting_of_ref": "indicator--d87591b6-a0af-4d84-bd2c-aff1333fd943", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b43459b7-af1c-444c-9edf-c26bd2769f0d", "sighting_of_ref": "indicator--b953ac63-3043-4915-98a4-a0f59506f8f1", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--170b0333-cfa5-42e5-99f1-a4dcbf078ec4", "sighting_of_ref": "indicator--20416d79-f56d-4776-abea-206ec822e8b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61f758ec-0b95-4572-ae04-bb51eb40cd52", "sighting_of_ref": "indicator--ecc59591-6f33-4076-8aef-6f570cec3955", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c87194e7-cf9e-41f2-be9f-5ba21021c3a5", "sighting_of_ref": "indicator--bd8b193e-315a-481b-8815-2a6c7870fc26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c3509bd-f205-4b57-8a46-4138c07130da", "sighting_of_ref": "indicator--d66468a0-fde1-4dd8-a316-5fc9eb246588", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1a55065-cdee-4dfd-9594-5ff0d47477e2", "sighting_of_ref": "indicator--d7289aa6-ac93-479a-8904-17222384b526", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18068c4e-bd06-463b-a265-262f85e9f8e9", "sighting_of_ref": "indicator--b2ab6225-b608-48f3-80bf-bd5639e2b87a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15311f42-6291-4267-98fe-02becb34b57e", "sighting_of_ref": "indicator--34a12ca8-1308-4bc7-8201-e3e77a36a482", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--696c4453-556a-42b4-9ee2-83be0c7d584c", "sighting_of_ref": "indicator--7b0c6d2a-fe0d-49c6-bee7-430c43b2ab19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f350aca-a0ce-4939-9006-07e6ecd6fb3d", "sighting_of_ref": "indicator--7bf7314b-eff2-46ef-9098-e2aa480610c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4ef27d-59e5-4c67-a6e7-d9366c8e26eb", "sighting_of_ref": "indicator--2efec8b9-ced9-4a1d-8ca2-94e3e9393438", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffdda615-71d4-4d44-b54c-c54c0ac7da0b", "sighting_of_ref": "indicator--30489283-81d7-4687-9b74-742cebc61ff5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e745e2b3-0e4a-44d4-a97e-9a55cb0f4ae7", "sighting_of_ref": "indicator--54f4f22a-d865-4ef1-a256-fd747c1630b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f19a3ddf-a6e2-4f67-8541-38d89ab1a38d", "sighting_of_ref": "indicator--97968d81-1431-4113-95ec-f7d246559a89", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--940abcad-3cd7-4696-8535-b2ac389dcc53", "sighting_of_ref": "indicator--a9c5a5e8-3e78-4227-a67a-45f8989eb4fb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a4962b8-5634-4887-b36b-4fc614b55abd", "sighting_of_ref": "indicator--9b3fa43e-9d8a-4d63-8ac4-ea4fe049860e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61a3c999-bbc8-4f7b-98b7-413b48997877", "sighting_of_ref": "indicator--a182a89a-4dd1-4cee-b799-a801ee21a8e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2f19d1c-5183-43da-adfb-f8ed15ca5537", "sighting_of_ref": "indicator--865562bd-0dd7-489c-a94a-1ccbef99a98f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27b73e5a-513b-4c49-a1a9-732350df94ff", "sighting_of_ref": "indicator--bf81e0b9-9e64-4c25-82ef-eb03e56a5f72", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41b1c1b3-1fd5-4e3d-9dc8-79db5f3b04cd", "sighting_of_ref": "indicator--db2a4731-e81b-4283-b12f-89d0a6e46725", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6c5f96c-6461-4b8b-9218-5ffe85a6b17b", "sighting_of_ref": "indicator--b1e1f970-d72c-41b4-b5ad-0651209a34e3", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b7dda2-655d-47c3-8290-e1879bdcf327", "sighting_of_ref": "indicator--d0fe73f7-4274-4fb5-b8f4-dd1f9d1db356", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04dc9a5a-26af-4ffa-a281-ce4d08c76d11", "sighting_of_ref": "indicator--d2351284-424e-4531-8ae8-dc916d70effa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b66a65-9593-4337-9d0b-dc49da6b62a6", "sighting_of_ref": "indicator--3510dd33-6ccf-4621-8a01-eeb52c6de800", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5780ce23-4973-4eea-b5a7-5df8443cbaf6", "sighting_of_ref": "indicator--64484ac5-1272-4d78-8122-0296b882f8e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd4a7c89-c707-4419-bb65-0660f31b9ca5", "sighting_of_ref": "indicator--e4360142-f561-469d-b192-bc1a8534bda1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6022a795-d8bf-4e03-9dcf-08bdb91363a2", "sighting_of_ref": "indicator--62f2a429-4338-412f-a6bc-8196e3222481", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--487e6e03-4501-4efa-81bc-b41e2f7f61e7", "sighting_of_ref": "indicator--5c56f6cc-3fc1-4409-9e17-f4ddcb425fb7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abc7ca4a-16e4-4d1c-a609-31368ed15ee6", "sighting_of_ref": "indicator--088567f9-2fd3-48ae-a042-51385244fbea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcfaa113-7f54-4e52-93b1-4db6d3970684", "sighting_of_ref": "indicator--7045c6ea-69dc-4253-98b5-d6ded2508ebe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05043d6c-64eb-4590-aa0c-e33bb003dd39", "sighting_of_ref": "indicator--b1570880-25e4-44ad-a3d6-763bc314eb2e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d07372b-50e8-4901-a690-a2f471b30b97", "sighting_of_ref": "indicator--217f0cbb-af15-4da6-92de-2efdd39fbdb5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bc45f45-ce87-4467-8e41-db4dd6bdacca", "sighting_of_ref": "indicator--81859e8e-b1e5-448e-96db-32e85499b0be", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03903a6c-0a11-4f5b-a95f-ee2c7c1d5ed3", "sighting_of_ref": "indicator--0158af09-4daa-4474-aff5-26d91dcfc4ad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f1c6ef6-571e-4b67-9398-0d71b71dfa5b", "sighting_of_ref": "indicator--1b2d2d81-429a-427c-b20d-c28eae655b4b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88596f98-1c31-44a1-9165-beb6893346c6", "sighting_of_ref": "indicator--d8602206-ba7b-4cb7-8478-31e963784a71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78239a89-1f43-4d15-9221-205775267702", "sighting_of_ref": "indicator--5c1ad494-e68c-43b4-9675-56b4a7b6731b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2085cb27-71fb-43e8-ac0f-80b945b1a36b", "sighting_of_ref": "indicator--722380d2-41e7-4818-9fda-b6409597c557", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3f98bd3-b6d1-4c85-b4fc-46abf7d8efb6", "sighting_of_ref": "indicator--d2e586ac-bd95-4e36-b38e-26355e296ec0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b45a502-00b4-478d-bd12-97234c2c2865", "sighting_of_ref": "indicator--1aa8a087-bfbe-4d07-bda2-5c6dad885521", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7b93797-e2e7-4b55-9a22-d93ad6c78386", "sighting_of_ref": "indicator--ca468f21-1e65-4af5-b78b-8ec52ced6d9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c01c1937-7d1e-4097-8061-d94a7a47681b", "sighting_of_ref": "indicator--98658c12-4507-43c3-9cf1-676ed5330998", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afab23f9-52d0-46d9-9518-9968664c8769", "sighting_of_ref": "indicator--bccc50f2-0e9b-4a4a-8672-ff5b2e87903b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc6f2afe-2a46-46be-9b99-2ca4465f9aa2", "sighting_of_ref": "indicator--2535907a-5265-47e9-985c-76d2d054d16f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--983a51b3-3d78-4022-9479-f5eb540a90aa", "sighting_of_ref": "indicator--705483c1-0651-4046-801c-3b6d44638c76", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6107a7fe-dc6c-4df5-a353-64e843dd42b1", "sighting_of_ref": "indicator--df82397e-6ab4-49b5-b770-d4c540504964", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cafb0705-6314-4e8c-b7f9-2dc90693e7d8", "sighting_of_ref": "indicator--cf519184-8589-4aa7-bf65-4b2dea361f38", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17abdd7f-21bd-499e-bd1a-181548dab3ab", "sighting_of_ref": "indicator--61513a74-9dbc-4d41-9c31-c4f26bde90bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6d056d7-5105-4fa5-966c-858d5681fac5", "sighting_of_ref": "indicator--b3610e5c-e528-40fb-87b1-b3e954bd7d8e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf0cafb9-4a4d-4f27-b00c-dd185404db94", "sighting_of_ref": "indicator--a67e1890-564e-4b59-835a-4eeff3e18129", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f18f8e47-144b-4a70-8a69-54b72bde613a", "sighting_of_ref": "indicator--3a5acd1f-16fe-4eaf-a110-721186efa42c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--694b4681-2f4b-40bc-b47a-370e6860cb33", "sighting_of_ref": "indicator--f8100d24-fdd2-4395-9a7e-834127b7512a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be07ee86-221f-4f3a-87cc-2d9e3b007afe", "sighting_of_ref": "indicator--36a7f797-916b-447f-90ed-7cc53eb3fbea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ece909cb-67cc-4085-a277-cc919dae3442", "sighting_of_ref": "indicator--a2fcb746-ebbf-4129-96ee-ce4e71ef2cca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--035cba93-e461-4134-b2c9-028f6ed8bc24", "sighting_of_ref": "indicator--3137e519-d4b2-48a7-9c8f-49992ac1921d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1573b179-3ca7-43d4-856e-0b1fb11a4b33", "sighting_of_ref": "indicator--071d5582-3c55-4bfd-8fa7-020ca42383f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27cc4f88-e797-4398-a274-36bb0d6077e8", "sighting_of_ref": "indicator--9d64fbc2-f75f-46d1-83e9-71bde2bdd962", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccfb9ea8-7266-4478-8c5e-906dda6e1485", "sighting_of_ref": "indicator--489a6dc2-f694-4f8a-9b0b-12ba163c9719", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f010ef13-4c5d-494e-ab46-609235c31a59", "sighting_of_ref": "indicator--c4feff76-3460-40fd-b7aa-b2e6bc00f5d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--556b8c49-9784-464f-8084-aa6087b555c1", "sighting_of_ref": "indicator--def73609-42f4-4f33-9764-af9eb380b8e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02dd4d36-dd67-4af6-a361-31baf31610ae", "sighting_of_ref": "indicator--a60aec5c-8168-42d1-bd75-8fb42ffb1bdd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18a81c8d-ff83-4f24-bae2-c1c148e51547", "sighting_of_ref": "indicator--4f8ce51f-f3b1-4d75-bbfa-05e7587e9172", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7df8b85-f9e6-4f79-8dd7-956f984614a3", "sighting_of_ref": "indicator--ad44bbc0-6fae-4cb0-a02c-e90d322586f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea8d64d-5d33-4121-80c3-8e9dfd36a8ea", "sighting_of_ref": "indicator--b39be8bc-aa38-4056-a5bd-76b3dc451cf9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c2cbda4-0d6f-4ea9-9cd5-6feb77aa5d51", "sighting_of_ref": "indicator--f0f96548-6239-4eaf-88f7-a5ce22f05754", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--911f91ad-9240-4884-9027-c73764350073", "sighting_of_ref": "indicator--cb53e0a9-00a9-45e3-8f85-e65a8b954e2e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b75c77a-d37f-493b-b919-32c4e79f9c51", "sighting_of_ref": "indicator--89b96be8-8ed9-4e9e-92bf-d67005f923ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e63f83d8-7927-4c1f-b5f5-3087702fd2af", "sighting_of_ref": "indicator--89b96be8-8ed9-4e9e-92bf-d67005f923ed", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b3e7c58-93d7-42bd-a697-07d8ca889b7a", "sighting_of_ref": "indicator--22977677-ed2f-44ba-a5cf-8a2ea5d16045", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d51e1c66-5dc0-4e92-912b-04e79f9d900a", "sighting_of_ref": "indicator--f5a30787-15e0-4119-89a4-269098768e85", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63af2d49-8fee-4d2f-bb7f-a78264ecc2fa", "sighting_of_ref": "indicator--3a7535ad-14d8-4a8a-a75f-0676b35e8a62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--506fe628-59c7-4e9d-8dd4-9510f3db7e48", "sighting_of_ref": "indicator--bdde7037-d770-450c-8646-c13a94de09f7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d45ec0c0-370c-41b7-b8be-c17a7db61d3e", "sighting_of_ref": "indicator--1cf66b36-9896-4f71-83d3-e6f2fb461afd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50645963-f4a4-4209-8bc4-24c50c685d2e", "sighting_of_ref": "indicator--9a2bc2b5-5b83-417f-a8a4-f611064d35c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4720853-ef1b-4bd3-bde6-1ac15067aca6", "sighting_of_ref": "indicator--176c26d3-e9ae-4390-986a-f1f5ee2d699f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc4f00e7-4b49-411c-b3fe-3eb5e7915ffb", "sighting_of_ref": "indicator--726c5add-aa8d-4b0e-9cb0-969b6d4ad5b4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95265b49-62cb-4259-afab-e96e2204d344", "sighting_of_ref": "indicator--92a6df27-ad39-4cc7-9c85-e0691454bb59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22c565f1-ec0e-4660-bbe1-7117bdb57e0d", "sighting_of_ref": "indicator--b7e2ad0d-dd0c-4f33-988f-13fb8cda3c1a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb6c08da-902a-4135-a65f-1fcdd6699561", "sighting_of_ref": "indicator--561f97f7-34a9-47ae-aa29-4ab07990ab92", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14d2ae68-72a5-42c5-b365-110a124380dc", "sighting_of_ref": "indicator--1d8581dc-8fa8-4e4b-849b-214fbc7c1674", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36bc6cb9-bdfc-4d6b-a820-c9222f9c0dc6", "sighting_of_ref": "indicator--817fffc8-5606-46b9-9823-514dc732bd67", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a095fe7-88e3-4520-9282-1de3d55d707a", "sighting_of_ref": "indicator--434e8082-73ab-472f-b935-6599c8a78a56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5152b4ad-8438-481d-820e-a3651be4044c", "sighting_of_ref": "indicator--3baf8bce-baf6-4f76-a9d3-e8c1c9a1a5e2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e852091-5d5d-4ea0-affc-ce55e168d646", "sighting_of_ref": "indicator--1f7c6c3d-00c7-432b-876e-916013401376", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55e307fb-979f-433a-bf0f-10a36aa00bf7", "sighting_of_ref": "indicator--efc74991-46d5-4038-9ac5-a358576327d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ad23854-4006-40d1-a6fa-bfa245cd42f4", "sighting_of_ref": "indicator--7bff7b1d-4226-40d2-9e9e-e584c51a3976", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58a8c35d-bfcc-41f8-b0e9-c68dd3ec1e71", "sighting_of_ref": "indicator--2bc956c2-a6aa-4675-a396-328dca4cd09a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91aceda4-b934-4902-bdd3-808b1d5cf7a9", "sighting_of_ref": "indicator--dd32c006-a4d5-492c-8197-3d944dd5d57a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67f8cb22-f60e-4cb6-b957-d9f4e2443ce5", "sighting_of_ref": "indicator--d39b426b-c44d-409a-aa62-b0fc4306389e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03d5177f-9419-4325-bbe7-24b5a1f9bfb4", "sighting_of_ref": "indicator--8e182384-4ce5-48f6-9efa-f8a75a283a61", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--208e033b-d23b-4538-8950-55c12659a386", "sighting_of_ref": "indicator--00dee9f5-31c1-48aa-9c95-4445ad9d90c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c919a3b0-c322-4573-b91f-b878a926686e", "sighting_of_ref": "indicator--5273a7bb-aba9-4b15-8f83-c35408e6c554", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bda06bd-adc7-4a3d-ba0e-18fec1453026", "sighting_of_ref": "indicator--81de90bc-dd0d-48f3-9ccf-9ca421b2a1b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29105b3d-11e8-4bd4-82f5-f599a2eea42d", "sighting_of_ref": "indicator--550c8166-1c91-4b6c-8e11-fd9fda2c5692", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be402568-1391-449d-a6f6-399ade6cc18c", "sighting_of_ref": "indicator--a451d2d3-9dbc-4ede-acd8-b77ee8c1c9d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cef799c4-28d1-44f8-8dc2-b8d18a0ca62c", "sighting_of_ref": "indicator--9f428b64-f8ee-4429-9d5c-da73e33db777", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--267e66f7-71ed-4f85-9f1d-48af3f8cece4", "sighting_of_ref": "indicator--a29dd5b1-d833-45d6-9a33-81ac4bc7af82", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--052aa09e-3640-421e-ac42-bba7aa8ec7e4", "sighting_of_ref": "indicator--dd94008c-dea3-45c4-9c72-850f5d0c0a8c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5345cbbd-6df4-4b4c-aff2-355604c3f5b1", "sighting_of_ref": "indicator--6383d957-f466-4442-b0f9-554128ca2b9e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b8cc788-f914-480f-ac4b-9f11214d2fa3", "sighting_of_ref": "indicator--4612e760-be32-4e5d-8eab-7bae4c95e8df", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a54ab22-3030-4bb3-a942-d1e9f607e83d", "sighting_of_ref": "indicator--92ec260c-8504-45c6-b733-c0666bfc504f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--526618f5-7e6f-435f-8265-b624f099fc40", "sighting_of_ref": "indicator--4ecfd8a6-dc19-4a4a-b361-0e7feab67aca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61d616cf-795b-4b4d-aad2-681211339abf", "sighting_of_ref": "indicator--923cd9d7-4001-44f8-bcd5-1d0f0c63ecbe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b4f52c6-2bfb-46b5-bd7f-57666afca60b", "sighting_of_ref": "indicator--ca867764-9268-4815-be48-5e1365f9156b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--810a43c1-6a25-473e-9147-e143bcd4e000", "sighting_of_ref": "indicator--b7925fec-8d00-4b4d-95ca-11d4d4da2e63", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66de0853-fbb1-4f23-90f5-e6eb55b00f25", "sighting_of_ref": "indicator--ae029c23-979d-437d-a289-55d8513f237f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b9a1599-82cf-4eb0-8551-b3646e5da809", "sighting_of_ref": "indicator--ead6d0d7-e1ca-4f72-9cd2-639f110128ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c15ad8a-6513-4168-8b4d-5ac3a830b2fc", "sighting_of_ref": "indicator--ff388557-7d5b-4375-a68f-63a96e3fe7aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fb59c9f-cdde-40e5-9f70-ce51b403fc8b", "sighting_of_ref": "indicator--f42d7447-44c0-4d29-8caf-4b8678137331", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73f03fb5-7e4f-4409-ac3e-b8b104e22bcc", "sighting_of_ref": "indicator--455960e2-0461-45f4-90cb-f2318db27779", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c74c60fb-ced9-4515-86bd-2327d265577d", "sighting_of_ref": "indicator--4fc49f41-d998-4174-9633-dc66b7ef76b4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3588201a-0878-41f2-bf10-dc820f4c1725", "sighting_of_ref": "indicator--bde50a68-8132-4589-9e1c-2333b69317ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c31299c-8189-4f24-b863-b755ee21f45c", "sighting_of_ref": "indicator--d20a8296-c902-478d-b0a6-22007f8d1cfe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2b8c22c-2481-4aa0-b590-e605645cf9ae", "sighting_of_ref": "indicator--abf516cb-2157-4f1b-b739-5739eb3f239e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d3894c5-5943-4d81-b1f6-da6513fe483f", "sighting_of_ref": "indicator--e74b5665-dcc3-4165-a001-6b53fd3d5a98", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ee438be-fbd5-4735-a339-78056296208a", "sighting_of_ref": "indicator--12964e81-67be-44f6-8853-27397fad04e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e94e7f2-e2f4-4f55-ab04-3f615ac3d53c", "sighting_of_ref": "indicator--af2c70c4-48b2-4c05-9566-303a896a8075", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaed49f0-4b9f-4564-9294-0100fab04dc2", "sighting_of_ref": "indicator--48bb9289-3d98-4d53-8e0d-83dce5ddde03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06f3fa54-2016-4e30-bed4-b84b3f675f89", "sighting_of_ref": "indicator--ef7e2639-2219-4817-bbba-8d8c98a80e7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7717fe1c-282b-42b0-aeda-d5697602cc5f", "sighting_of_ref": "indicator--9eeff4cc-68be-41a2-b674-37713e2508d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5239876a-e2c1-4575-b4dd-d1005fa640e9", "sighting_of_ref": "indicator--26576091-6a8d-4000-8fe2-0964887a7bf5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a965ecd3-371f-4da8-900e-3da0db1b60fb", "sighting_of_ref": "indicator--f90f8dd8-0051-4eb4-a1cd-893a1b782c04", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--844a9881-8f4e-4b72-9030-ae364a4a8f11", "sighting_of_ref": "indicator--b183c93b-b3fa-4c0f-94c7-ed0535fab5f9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba976d71-2880-4e20-8d41-420cfad1b659", "sighting_of_ref": "indicator--53c99ee5-2e45-4bb5-bfad-a04f367238f8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e298d6d-ad84-4c7f-aa57-2edba898a37a", "sighting_of_ref": "indicator--c7b118a0-358c-4e9f-bbd3-3938cd9c78e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff88ab42-cd53-4b63-937b-d7cdab884a48", "sighting_of_ref": "indicator--19e7e410-cd82-4187-89fb-a735a153a771", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecdecb46-ecf9-44c8-ad8b-2e955e362be2", "sighting_of_ref": "indicator--aa8a0b73-1c0a-47c9-9b28-87a31b763362", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05bc23ea-4eeb-4147-b152-789979e9d183", "sighting_of_ref": "indicator--6a14b813-26eb-4df0-8b10-9e8a7150a1f7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d2a6fa5-8301-4f98-9613-9fd32bd5245a", "sighting_of_ref": "indicator--eabc4a46-1590-459a-b1cd-d1eb122b92f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88348e7b-097f-4757-b07a-58e1a7aff513", "sighting_of_ref": "indicator--71edea2a-6ece-40ff-9dae-d3bbccf526bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--942205dd-772e-490d-987a-0361045bcec3", "sighting_of_ref": "indicator--8f898f25-5edb-4003-8b4f-05cec36ceda6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--384aff8e-465d-45b6-a8ff-e61bdcfe298b", "sighting_of_ref": "indicator--b6a43dfb-556c-43c2-8ad9-40eb4b90fe1a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ded551a9-5a56-4a7b-813c-260bc39bf554", "sighting_of_ref": "indicator--cca5ab1f-e826-4ef8-a731-fe0fb5c962ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8718c20f-6659-4321-8c54-9f99b80552ed", "sighting_of_ref": "indicator--4dc17b5f-4000-46a7-b56c-e19a2f5aa634", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25bcfadf-0c2b-406d-a9d7-eef3ce6e3216", "sighting_of_ref": "indicator--fee9af82-320f-4915-a27e-4af43d02da7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beea2c7f-6b12-44ec-a2eb-a53dc0845666", "sighting_of_ref": "indicator--279fd634-b259-403c-8ce9-b4472f09fe96", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88fda4c6-a5ae-4fa1-8de6-45d23d482b3b", "sighting_of_ref": "indicator--2fb2474d-3091-48de-a7fb-51afa21644bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe77f296-aadf-4694-88f5-c7b826c4d9f0", "sighting_of_ref": "indicator--8abf55aa-b473-41ee-83c4-a022b1cf4aff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18e3cd16-a0be-4033-9588-9c824f8850ef", "sighting_of_ref": "indicator--27228b9f-7d15-4595-a12b-6fe52194d634", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b903fe4a-d099-4ade-b38e-53664d6b247c", "sighting_of_ref": "indicator--be4fa1d5-c26e-415f-9fcb-51533982ae2b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b36dd2ec-2840-4d06-bd9b-cd4def54c6ae", "sighting_of_ref": "indicator--b6db4d7f-a4bf-4184-a5f6-bb5a6c42ae64", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42fb44ca-2b9d-4a92-b8fc-6b361e2b4912", "sighting_of_ref": "indicator--9edf51ca-4155-4591-8972-794ca6d62243", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--961f7c2a-cd41-4843-8b42-fb066a8f8fad", "sighting_of_ref": "indicator--ddbe0ac9-eed7-4fc3-94c0-465620266f47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f769867a-a0c4-45c4-a5e7-f9ff801eaaca", "sighting_of_ref": "indicator--42435954-eabb-4a5a-a02d-38ec8bd2bfd8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbf3cadf-bd09-40aa-9a3b-94102a840c9b", "sighting_of_ref": "indicator--cfc16635-ccb3-46be-ba53-5b57a9ca0513", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a378036-e90e-4de8-bf0e-a06b545b1706", "sighting_of_ref": "indicator--9b3e16e2-86cf-4d6f-bb32-2b1d941b5e5e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf2de774-9633-45b3-a35a-f985b76857e4", "sighting_of_ref": "indicator--acbae8d5-6ad7-4024-9a0f-c0374324174d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7af411a-c917-44ef-9fff-32bc2e1233bb", "sighting_of_ref": "indicator--ac844ddf-1baf-424c-9384-3ddfbb63ca71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90171526-663f-43ad-bc06-fb7d266643e0", "sighting_of_ref": "indicator--8fb5d49b-0f44-4fc3-bab9-15243a504a19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dc48952-b25c-427d-9b06-646d5556d9fe", "sighting_of_ref": "indicator--ecc220a1-cfab-4ea9-8563-105d667fd8cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f9b5ce4-d43b-417a-8ee2-f1052d45827e", "sighting_of_ref": "indicator--4210d72e-496b-4d0d-a312-5348626d0c7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb524ff4-8145-472d-9753-34d5dcef5d51", "sighting_of_ref": "indicator--ebcc3e44-4cf9-4ec2-be24-29e49f76269f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e46c184-7508-4e76-a389-98e742f2cc22", "sighting_of_ref": "indicator--3c521c00-3060-4847-b1ef-05111708ceef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f24fcd0d-75a7-4d62-ba2a-0a4a0caf062d", "sighting_of_ref": "indicator--56ca1747-6ed7-47a3-b816-79df59352045", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c52989d-d0e5-4246-9fb5-3df3cfe2dfad", "sighting_of_ref": "indicator--c8ef504b-68a8-4f01-96e9-f84add18fbdc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b23bdd3-2e41-48e7-af67-5ca26db507d8", "sighting_of_ref": "indicator--dc98a896-f123-40c9-abc5-f649ed52107a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4ecfa08-f064-4410-8c72-8761c1aadff3", "sighting_of_ref": "indicator--1fbb7d8a-94aa-45a3-a9a3-c9760b88e005", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eca97a1a-3724-43d4-8e38-62b35cc92220", "sighting_of_ref": "indicator--f3a531ac-bf8b-4d95-960b-94a7e3e465bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ffcef46-ecc9-4bdb-b680-0151cb46fab1", "sighting_of_ref": "indicator--6ff4a11c-91d6-44e2-9f76-5d5327adf856", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f3c221-69f3-4186-b699-498607d7d285", "sighting_of_ref": "indicator--096911f1-0af2-492e-8d8d-1e034ccb680a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--507bf281-55a8-4d45-8780-403f67be24e1", "sighting_of_ref": "indicator--caf69d0d-17c8-498b-9ed6-f95f870bd16e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3d2e38b-863a-41cc-a017-178b7acfb1ec", "sighting_of_ref": "indicator--53aa2deb-805d-45c3-812e-3e160b3334d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feb6aad9-7686-4386-ab2a-a82a2c57176f", "sighting_of_ref": "indicator--30cd713e-1e56-437e-9b68-12cb6f16ac5c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f140592e-58a7-4c85-8d6b-a5e6656a866b", "sighting_of_ref": "indicator--f860ff1c-8c7d-47e1-8c8a-00f98e95a85f", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33c96082-6696-4722-8d20-81999051feee", "sighting_of_ref": "indicator--f860ff1c-8c7d-47e1-8c8a-00f98e95a85f", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e545ae87-ae01-4f5f-9f7c-fadbff8f04c9", "sighting_of_ref": "indicator--0c66cf41-4a33-4de6-84b6-e4ab86f8b7f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75762fa0-d734-414a-8c24-e5360b94a2b1", "sighting_of_ref": "indicator--dc8ea5ac-d614-4086-8448-6def0f04c690", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0e4254d-d49f-4f20-80ac-338ec5c4ca0a", "sighting_of_ref": "indicator--9af2049b-baec-43e4-9a87-6b8575708bd1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc80c0b6-8231-418a-a281-c2fb4031cb40", "sighting_of_ref": "indicator--6d201f91-6eaa-4567-8071-c5d2250635ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--016c5086-8ae0-414e-aff7-229f63a77881", "sighting_of_ref": "indicator--2762f83f-aedf-49c4-9db6-80bb98b0b5f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e7a140e-e33e-4cd1-92f2-ec76fff6ee40", "sighting_of_ref": "indicator--ef21dfdb-10f6-4d06-aec8-a71490eed430", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e11863c-0c2a-4ebf-a988-222424987de2", "sighting_of_ref": "indicator--ca38aefa-713c-4922-aced-e5ff367bfbfb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b70bdad-c4d2-481d-bc8d-7a40e2567bff", "sighting_of_ref": "indicator--a9f206f2-9b98-4ae0-9a05-05fc5b7c763a", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b062ef05-dc7a-4718-99de-9163b6a5926a", "sighting_of_ref": "indicator--bd3013b5-cf60-42a3-a42a-aab780485e88", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--643965a6-f887-47ca-a680-8d32cdc83a85", "sighting_of_ref": "indicator--ea0afed3-bce9-45e2-ab7c-fabaf3fc5377", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8625a7e-c9a2-443f-aa71-7ad10001b201", "sighting_of_ref": "indicator--f5c7686b-2a67-42c1-9af4-f67b94c1d7c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e492f474-650a-45e8-91af-6766dca16483", "sighting_of_ref": "indicator--8e59cf9e-abd1-4ada-acac-f398c883713b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e68db19-3929-447e-a03d-7e105175dd9a", "sighting_of_ref": "indicator--521716a6-0d4e-43a6-8d83-d82b5d08ec50", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e858c2d-d7c5-4d23-bd6e-2326672e84bc", "sighting_of_ref": "indicator--aed9ee32-1b12-4221-a3fe-ffe1004edbbd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c18d8061-ba4d-41f1-8c19-9e990f97d3fd", "sighting_of_ref": "indicator--12b8ec38-54c1-4d32-900e-908ca49ad5fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e8cd61-125f-48eb-b075-afd49f2fd2f8", "sighting_of_ref": "indicator--a67c38f2-db7f-46c7-9a59-93f0bf7f1bcb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ffe1229-fd98-416c-bdf9-c7d7d1c324b1", "sighting_of_ref": "indicator--fdb298f4-2515-48a1-878e-ebaf31955057", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61696eac-aa45-48e4-8d2d-0e781d0d7dd8", "sighting_of_ref": "indicator--f8c61b54-549c-46c3-8d3f-94c904f0d864", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2c584b2-8d19-4b96-ae95-6fbe2a723aa0", "sighting_of_ref": "indicator--a53b63d2-edbd-4b57-8f29-833994238945", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c3d943d-5f4e-44da-9a9d-a7f3d5d4f0da", "sighting_of_ref": "indicator--9ac15293-cf2f-4739-8bf7-e9893a0969b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8511b5c1-c049-4b91-ba42-9336cc0f2aa7", "sighting_of_ref": "indicator--121fb68d-33ca-4862-8bdb-538bbb38dd9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1992fda4-8cee-4f83-b889-9ba0d2809b11", "sighting_of_ref": "indicator--70f723cb-1fac-431c-ab4f-913129aa1644", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--361ba045-fbb8-45f6-95a7-622c87a52913", "sighting_of_ref": "indicator--da968464-5a1c-47c0-aa1a-ed4dc6493f02", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--015a3ce3-3d27-4a40-a26c-b67512df5457", "sighting_of_ref": "indicator--34d3c563-bc8e-4798-92fe-a237ba1c5278", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5abc1f2b-c587-4107-a0fd-bf5c37fc2e21", "sighting_of_ref": "indicator--73d8d301-77da-4384-b6ca-47a21a68565e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c2510cd-fae5-4083-a032-c4fd4970e627", "sighting_of_ref": "indicator--d86dc474-43bf-467f-a218-c038e5731b90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa2d9f29-9bdd-47b6-b70b-c9a00d208734", "sighting_of_ref": "indicator--7331cb52-aca7-4f72-88fc-aa414fdd1f2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65d0cf8a-4a43-4d74-a168-b7d41b959367", "sighting_of_ref": "indicator--5e68bea7-2c53-4dfc-9305-507533ee9ce2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fb9a57c-b220-4ecb-a24b-97835597273d", "sighting_of_ref": "indicator--d5aa6909-f1a0-4f1f-8c49-df73d523f353", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4351d904-dae2-4d10-9843-7e8542268e65", "sighting_of_ref": "indicator--e7bdf232-002e-4aa0-b2c3-409e26bd5098", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89031269-d674-4ebb-abbb-661b18474945", "sighting_of_ref": "indicator--f5f83849-8f3c-4ffc-bd53-2de43449a6e2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e95cc89d-c0fe-4315-bb94-24a6a382f624", "sighting_of_ref": "indicator--82115191-6d6c-4e69-9010-84511e5e8720", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77e1c920-71fc-4d5f-9570-cddad896bbf9", "sighting_of_ref": "indicator--2591ee71-7916-45e3-8eba-f6f397f674f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374b61f2-52cc-4ba2-9c0c-48707cf87231", "sighting_of_ref": "indicator--443414a4-4219-4372-911c-ce35a1af548f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3f0f03f-3e7f-4022-868c-b8490c5ab53e", "sighting_of_ref": "indicator--07e15776-d3a0-4e0c-8f61-464e5a7e1611", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--011d6b77-cdb1-4d5f-97b5-25ddda43751e", "sighting_of_ref": "indicator--eda847a3-dbad-45d4-b716-cd1fb8f23983", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--169eacd9-42a0-467b-990e-9fc19bd5a7ab", "sighting_of_ref": "indicator--891a5d3a-3adf-452d-bb1a-0e17fe379089", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84c5b015-74b5-4efe-9056-6c31d13192b2", "sighting_of_ref": "indicator--0792d998-d51e-4371-ad77-b51ab6c31fe3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a77a3153-3f52-47eb-9d33-ed10c6149410", "sighting_of_ref": "indicator--618f8cf5-d5e0-4a62-a62e-45f07da42c3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09990cc5-d1b1-4a2c-967a-5acba6ea9106", "sighting_of_ref": "indicator--5b01c417-75b3-460b-992b-abd80f500bd3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66db1748-208e-423d-9d99-a0c6487dbfc2", "sighting_of_ref": "indicator--10c79d13-2c92-4915-a6eb-432451683959", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bed8a1b-66fd-4b73-ac99-569a83f5de26", "sighting_of_ref": "indicator--fb306458-7c6f-4d8a-8934-db2de8b8bed0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d72a4947-d199-4ed0-8bdd-bc1cfa58b6ab", "sighting_of_ref": "indicator--9b23d1c1-26ad-4c0e-a870-04407074fa4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5685c353-905e-4538-93ec-a3106f1269e0", "sighting_of_ref": "indicator--5fae57a9-7eba-4ac2-9bab-d2fc2fed3afb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcd9806c-3ae8-42c4-b8f0-65b37a4df568", "sighting_of_ref": "indicator--a4c081b6-535b-4c54-9bb4-d6d719db234d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7389d5d0-1cb9-4406-b231-9019f185e0e2", "sighting_of_ref": "indicator--80361176-bf38-4115-abfd-ebd77dc1e0bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2450e88c-bad6-42ad-84ed-90c29cb8bde7", "sighting_of_ref": "indicator--d5b579f5-00ef-4588-9f6a-6ff7d302727a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--893599e9-82b6-4427-8933-c370436bd1d4", "sighting_of_ref": "indicator--c26efdcf-9223-42e0-90af-943bdd24dc9c", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--405bfc06-561e-4294-b3b9-aa44ed50b1b5", "sighting_of_ref": "indicator--1e6353f5-3f99-4ef2-9cd8-6f2295684c21", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e359e078-b9cf-4be4-a75a-4e01a78f79dc", "sighting_of_ref": "indicator--e38f7265-306f-42e2-a6fc-ceed1fca4d90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--740c5c3f-3cc0-4f4b-b119-ced3fd72ad7e", "sighting_of_ref": "indicator--d13f2af7-e690-419e-92d5-09e2321df0c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa48bec-e9bd-4142-984f-20e5d0a4d016", "sighting_of_ref": "indicator--0c31b136-0893-49b7-9009-37ed9277ed7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22507dfa-51c8-4d99-aee7-54e581eed977", "sighting_of_ref": "indicator--2c75d01d-8c33-441f-93ed-1e7d5cc16997", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4425e82e-0a7b-49f6-87f9-1a1b4a6895c6", "sighting_of_ref": "indicator--1b68e524-c3f5-4385-8df5-eac953978dee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1c76e12-2d61-44f5-8527-e7ec4eb5bed9", "sighting_of_ref": "indicator--c91edf2c-3b91-410c-8bd5-e04eed229dfd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f77e5217-f45a-4b33-bd10-f1eaa56610b2", "sighting_of_ref": "indicator--e00b2e05-dce9-4aff-82d7-8c914f8675f9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2360bd35-b483-45ee-a1eb-34b5e2924a96", "sighting_of_ref": "indicator--f3d3c5c3-1209-4d94-8421-a77f81a580d2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c905155-d927-46b3-bcba-c4e7ac434b2b", "sighting_of_ref": "indicator--d772cd61-1cd2-41cb-8e85-d2de83c25b74", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f525ee5-4927-4715-9fc9-d0e54e6d6899", "sighting_of_ref": "indicator--62c7e648-dbd6-4ebd-8ec0-5480ccf45557", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--658dc8fa-65b7-4833-aa62-abef3cad5d4e", "sighting_of_ref": "indicator--83e10c87-0275-42ad-8d49-196a992c58b3", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51d5bd88-d3eb-4888-b303-2c1d97b8f7a3", "sighting_of_ref": "indicator--fd44d6d1-fdfb-4cb8-8c86-6a54dd95a65b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--753df378-49a8-4786-82a9-4cef5225d823", "sighting_of_ref": "indicator--bc01be4e-a4b3-4946-b0cd-aa63aa0491a4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac6e9de4-c30e-40d2-989f-7fe5eb5bf68f", "sighting_of_ref": "indicator--23e3bfdb-017d-499e-af43-926f6bb863c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3da3b04-51cf-4c4c-959c-c6ca627ab6e1", "sighting_of_ref": "indicator--07268166-7f8b-4549-930a-5be7015fd342", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c042c34e-4ca1-47ea-a088-aad7113d3b0c", "sighting_of_ref": "indicator--23758db2-668f-4368-bc2d-2360be182477", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0334a74-df65-4965-985b-063896cd8cd6", "sighting_of_ref": "indicator--4d755c30-4852-4368-8cbf-3b11fadab651", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d345be9-32ea-416f-9ab3-5294ca17c64f", "sighting_of_ref": "indicator--5470adc6-c489-4758-b7b3-ba0c05c92782", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8a127ea-960f-4dca-873d-5544b3705bca", "sighting_of_ref": "indicator--c4f8a4e0-0c4e-4840-864f-08a3638dc371", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b22ee32e-79aa-44e0-a6fb-658de9e9504f", "sighting_of_ref": "indicator--ef232348-2ce2-4e25-8a99-a4cde3b29130", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26956aea-70a8-4939-8e30-de762a1eeb3f", "sighting_of_ref": "indicator--e51ba45a-63e7-4d3f-83c3-24c1aaa608cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eed0d195-5753-411f-a965-a0bd7922c924", "sighting_of_ref": "indicator--5f8bce97-8045-4088-bc87-3d962601d6fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f148992-7a91-4edf-be2d-73050a2dfac9", "sighting_of_ref": "indicator--e620f663-6869-414c-89be-b025400fca5d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28408d52-8570-4fe1-a396-ca0eee518316", "sighting_of_ref": "indicator--64616f3c-45c3-4be7-ac9b-2363dfee97c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82ffdef6-07d7-4ac6-b940-355d01795d9b", "sighting_of_ref": "indicator--922257fd-164c-4e9f-abb0-1ba3d1b34f03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--417bf18f-6cec-408e-bebe-6e9e6f8aad13", "sighting_of_ref": "indicator--de4188e9-6145-439c-b3b8-589582d7a374", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebeb4b80-562d-4912-a4ca-993f096d9881", "sighting_of_ref": "indicator--709b67d2-8979-444a-ad91-1da572088bdc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61dcf6d6-9562-4ea0-8126-1a81d2ef41dc", "sighting_of_ref": "indicator--4047add7-cdc0-4ed8-910a-1b0bee03ae2e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b38b065-5b0f-4360-af47-54b8f22689fa", "sighting_of_ref": "indicator--a9ddd489-b110-4599-be4e-e2cf83b8224b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d697dc-dd8d-4894-ae1a-60de732007ed", "sighting_of_ref": "indicator--35b7c652-fef2-42d6-8ffd-5b55c46411f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a76494be-0980-4230-a4e1-61cee40e6c38", "sighting_of_ref": "indicator--96365a04-6f73-4f5f-b312-a3e6e6140af0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66de7ef2-93d7-48f5-8d31-dd16cde79c25", "sighting_of_ref": "indicator--42c4f03a-ed04-4ea3-986f-808d0a53f2e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ca23f33-4edc-4bb5-89ad-54aa6ca687dc", "sighting_of_ref": "indicator--d4034665-08fa-49fc-9311-3b064bb6417f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da8ee0ec-477b-4932-be4f-32a9a806c9c4", "sighting_of_ref": "indicator--972ee51a-5ca1-434a-b603-aa4d48b4f4e8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56b14f99-8fe0-47c7-b9a5-a1fd1dafed1e", "sighting_of_ref": "indicator--3532e09e-ffae-46cc-a52a-2f952079fdfa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--914ef49b-0ab4-4bbb-9c12-ea2a113016f6", "sighting_of_ref": "indicator--7ed099a1-9993-4bd5-a47a-681684e4073c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d66052be-3bbb-4985-8817-df8016da1daa", "sighting_of_ref": "indicator--57eea8c0-401e-48ca-a555-1184997c9ee6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e9ee245-a2e0-4959-9e64-1ca50810e58a", "sighting_of_ref": "indicator--b0060875-e154-4b98-9d0b-1cff1664e906", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5b9be77-a7be-4c91-9453-82a487e004b3", "sighting_of_ref": "indicator--d61081ef-d614-4fd6-8688-988884018150", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4a7f4a6-560b-454e-9549-d3d21e76842b", "sighting_of_ref": "indicator--acd21ce1-36d0-4cc9-90fd-704fd28d6abc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aad04ef1-047c-4c5e-a51e-54092b323d0c", "sighting_of_ref": "indicator--3faf9895-e02b-4cfd-853e-26c88d695436", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91914050-0777-49e2-80d0-7f347cfaace5", "sighting_of_ref": "indicator--be4e3b58-5033-4b7b-989a-55deca5ba2ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36ce6e5e-bd01-470a-a3b0-b3779d8cdb24", "sighting_of_ref": "indicator--e4e59f4b-d5d1-42ea-85ec-5dca840514d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374a3314-8cc8-4f26-9716-aa931e5d06fb", "sighting_of_ref": "indicator--16f0cf29-9ec0-4754-a11b-44dedf8a4dc6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--795afe70-b7cd-45cd-a158-c1c80d518c26", "sighting_of_ref": "indicator--3c673417-afb3-4a59-a7ee-4eb09a2e0f05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19e880b6-100b-4a3d-95f5-a710e5bba6ae", "sighting_of_ref": "indicator--d5d4535a-7ebf-4423-9bf3-9e74804a81e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28e66962-7702-4de0-a15a-31a3b10ba108", "sighting_of_ref": "indicator--e3df0fb9-70e3-4a93-9311-4208661d68d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebc9da03-193c-4ec9-80d0-89afa594ecab", "sighting_of_ref": "indicator--6e3f8bb4-ddfe-4134-a29f-b9ab807e6d74", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f7ece80-a361-4e83-acc2-376f9c61617a", "sighting_of_ref": "indicator--5175de01-15dd-4aa8-9244-3e726a1e82be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fb7b7ff-e6ad-4dc1-9dbf-2ee65cd3e635", "sighting_of_ref": "indicator--6b2e2666-724c-4562-bd6d-9ac60b39099f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--857cea0d-3f69-434a-a780-9321cc6f1f31", "sighting_of_ref": "indicator--9035f023-da9e-42eb-b9a6-dbec1d7e47d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc25bd51-8270-4150-8b5e-197db85618fa", "sighting_of_ref": "indicator--ea0e9370-f65f-4661-aae5-27e1e587b61d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34799547-33cc-4ff4-8f58-331524461a64", "sighting_of_ref": "indicator--a288d5bd-6190-4c98-8482-4cfd811777e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cefe9afd-dc54-438a-9196-ca4f24a6d025", "sighting_of_ref": "indicator--749becf5-5378-4cf3-9523-f67145800726", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--895cfc4b-2f05-4d76-8299-385b31d28347", "sighting_of_ref": "indicator--4f78693d-aff5-4f1a-9142-a4d8d9d2eab4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a64ebc9e-bd3f-4ab8-ae15-79e34f333cee", "sighting_of_ref": "indicator--2f0ecb9a-da98-475b-b01f-44bd1deb29ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--177e9dd8-df02-4a7d-bd81-54a8f87c487b", "sighting_of_ref": "indicator--a27a043a-125f-4979-a9b1-5c8dc25ae2be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7a09ce9-c045-463c-b5ab-030f73bcd225", "sighting_of_ref": "indicator--b474b7f3-d012-4c9d-b487-15ece57d6188", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9d2b08f-2cac-4b75-be04-9d84fd87f4ed", "sighting_of_ref": "indicator--fcdbba45-5f96-4b59-8999-4c762d8c1506", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1619c98f-fe44-4010-bb27-88882ece7a7f", "sighting_of_ref": "indicator--ed540b1f-3700-4a83-8fb0-66774e6e417a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49d9f7d9-61ab-41f9-9005-419e00847432", "sighting_of_ref": "indicator--fdd49aab-eed7-4832-8ade-e843e0dd6adc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ad5dbde-760c-4f0b-9c39-45176c3a3bb6", "sighting_of_ref": "indicator--d8da3673-7319-4279-9605-fd8e8e3d0451", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4d9f6e7-b0ba-4c83-ba8d-f99418d62297", "sighting_of_ref": "indicator--ee5607b8-8b74-43b8-bd03-ca1c5008e3ad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53484609-71ea-4370-b0e8-9a2e91349eda", "sighting_of_ref": "indicator--b5e9f636-9a92-40b6-8a36-fcd410046c1c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55cd06a7-33b8-4ecc-a4bd-4504682dc11d", "sighting_of_ref": "indicator--db98d2a1-2acb-43b4-b766-dd95afdcf0f2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b4b7e81-7f9b-48c4-b108-86e5373cb4ab", "sighting_of_ref": "indicator--77793272-abd4-4522-a5c5-2ee24212ffe8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97be8586-3558-4a33-bed4-c9e1cad273b6", "sighting_of_ref": "indicator--97dc7099-506d-4305-889c-dfd7c6549666", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ce05ac0-9856-4e41-97f2-082976b0f936", "sighting_of_ref": "indicator--57513d19-4152-4bba-b9be-94c5cd818347", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f3d686e-ffca-4dc9-b592-6a4706b64298", "sighting_of_ref": "indicator--c1b9dc40-7f92-4b0b-864e-8733569af2a6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ab4f105-7f9a-4eb2-8aa2-c7961c930dc1", "sighting_of_ref": "indicator--5ba4d6b4-a518-452f-a2b7-155bedab22af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86abebc9-a504-4bb1-a4d1-22254e5438d1", "sighting_of_ref": "indicator--bd51c146-9f8d-4ae9-8854-69b4b9bb2f47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68c35b1d-a97f-440f-9a25-67a94fb50c87", "sighting_of_ref": "indicator--706a805e-0af2-4c76-98a5-4e9f3a4835a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef96e453-5bf0-4dc5-bfe3-9b88d947a39c", "sighting_of_ref": "indicator--c265f37a-4f38-482d-a8aa-3be9ace6d418", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26b64fbc-16f0-494c-add8-59ce0923eea9", "sighting_of_ref": "indicator--3bfe7e28-b1f9-4e2d-b502-37c03bfb6eed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15e5b37f-0467-4359-b3b2-0db52e825d00", "sighting_of_ref": "indicator--016abedc-1ec4-451b-893e-4569651e6a1b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5ff7ea4-8df5-495c-a522-81856e5b2285", "sighting_of_ref": "indicator--cd10ad00-6999-4f4d-a97c-6e3c95dd606c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--384043b5-10f5-4b83-a610-9171ff2c3113", "sighting_of_ref": "indicator--fa35d3c5-cd9a-481a-a12a-704b1ddfe691", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e639d9bc-db18-436f-911a-dbc47ec495df", "sighting_of_ref": "indicator--e2c08017-8cc3-4405-90dc-95839d16136d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48eb8b84-068a-4d85-aea9-f828fa041c72", "sighting_of_ref": "indicator--71d9624b-2788-4726-8c4e-09ef72cbbd2e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07481b74-ad87-48dc-b65b-3dc910d4c070", "sighting_of_ref": "indicator--037ad896-5443-4c69-9482-70662b7d86e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fed83efa-974d-4cfd-ab6c-e6e730698bc1", "sighting_of_ref": "indicator--f32d2c5b-bf33-43a3-b342-e8c163a48530", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--473eff50-f13e-4d95-89a7-458f70a94337", "sighting_of_ref": "indicator--97900389-6bd4-401f-8913-8b7f04ff2a48", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07ce3cb1-da50-4993-83ea-a95b0f1ce080", "sighting_of_ref": "indicator--6a79e04f-5d59-4f85-8ee9-6c84a186b995", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cfc83a5-442e-4557-8097-f6a151a3e43c", "sighting_of_ref": "indicator--920b7b99-33c9-4a85-8e57-6da5fa75e64e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cf7f79e-a7a1-4321-a25c-672c6f96f410", "sighting_of_ref": "indicator--1f3b4ec8-1130-4a12-9cb6-4baa933f6af3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a906908-af4e-4dfc-a59f-0c011f16a967", "sighting_of_ref": "indicator--67d87556-3139-4424-a61c-45c70644758f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--588da8ca-2e91-442a-b8d1-3cfe5758c9e8", "sighting_of_ref": "indicator--6da13d83-a956-4610-8353-29f4bdc0aea6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bb76fa0-b8fe-4f51-8eea-71657b960aa9", "sighting_of_ref": "indicator--3dba6322-1621-421a-8091-9f0368c0b4c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fbdcb55-2b9a-4d82-90cc-f140daa326d4", "sighting_of_ref": "indicator--8a1cbf01-859f-48c5-8279-84f29ff05ca2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea3f9f71-2e88-47d6-9dbe-1209c22442ac", "sighting_of_ref": "indicator--d7072f8e-50d6-4f9e-b6ab-35d6fd1b94ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92eeb856-9de2-40f0-befc-14a27b7e559a", "sighting_of_ref": "indicator--eabf7a08-65c7-4f44-8d1a-4548e53b477f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--760d0de9-9a9d-4e9c-8371-00a92d6e2682", "sighting_of_ref": "indicator--a53ee228-9177-4fa4-a64d-9204cbed73b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0d66a10-c184-4a55-9619-6d6ac9001cfb", "sighting_of_ref": "indicator--7885f7b5-56f2-4c0c-8d43-8ad64b1e8080", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26a2b460-f706-4196-bdde-13f380728f59", "sighting_of_ref": "indicator--5681934b-2d4c-4fba-9bc7-6764f35d0d57", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10b35e8a-a01a-4f2d-b2f2-311d412279b6", "sighting_of_ref": "indicator--8f916cb5-a0ad-490e-b1b0-e422e6f65873", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a10d878-3135-40ff-a1c9-68895f72c58b", "sighting_of_ref": "indicator--85a275c9-9e07-464f-898f-d22c3e32aa77", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9d77075-a431-4e17-a373-7f81e6e784c6", "sighting_of_ref": "indicator--b5832505-6711-48e4-88ee-868082293ade", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db748b2d-0582-4766-8ae1-fc92373a5a05", "sighting_of_ref": "indicator--0d276517-d7c5-4903-9289-96caacba298c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184eac32-a869-4233-9925-836bbf5f70c6", "sighting_of_ref": "indicator--7f6c574b-8eaa-4e41-9419-4e3659e16233", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0f6dac5-908e-430a-96e5-a6643e85bee0", "sighting_of_ref": "indicator--02b343ac-48bd-46d0-9c09-efa8547544b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dc95e56-8da2-4cdf-a471-efa39aee5d41", "sighting_of_ref": "indicator--f7ca64ee-f1a5-49f5-800c-af6c809affc4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a99d7148-475a-41b8-95e0-9271d316f228", "sighting_of_ref": "indicator--9c72ba6a-0b84-40e9-a4f2-192b62883991", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8b7e1a5-cffe-4e35-9d6c-127901cb32c7", "sighting_of_ref": "indicator--c9a1b392-6256-43dd-8d0d-deafc4ed680f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9556185-f9cd-4703-997e-5c8b93dc6169", "sighting_of_ref": "indicator--45cbfab0-4971-4232-8f66-400ad1b314cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--199773d4-36ec-4184-9479-7920b9f3c140", "sighting_of_ref": "indicator--fad79556-21be-4d62-a5a3-ae4dc9ab7064", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca09dbc0-dfa7-4320-b3c0-4877aaa85824", "sighting_of_ref": "indicator--db28fd8a-5b99-4066-8521-73203db25371", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ace9b485-f55a-4811-a1f3-184bdf44d68d", "sighting_of_ref": "indicator--e15960dd-ab4f-4e77-9cf6-165fe5d7aaaa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--736d1fd7-8cd0-403e-84aa-1f0eb8b5b286", "sighting_of_ref": "indicator--c4c4713b-40f1-4263-957c-8a353366b126", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a21a5818-5290-446a-85ef-974c1f34158e", "sighting_of_ref": "indicator--4441797c-8919-4093-aa84-c29f2006eb80", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8267b8a7-9970-4f15-9684-56518811cc1f", "sighting_of_ref": "indicator--c7f8d3c5-a426-4a39-94b0-14edb927eeb1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--277215bd-d8f3-4019-ac36-e0565d6226e8", "sighting_of_ref": "indicator--4320dbaf-c1db-4a5f-897a-c069fe995726", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2395e729-5994-4ba5-98ca-57894b259424", "sighting_of_ref": "indicator--7a5415fb-2f73-4ec2-8c2d-f9aeb8149f50", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e8cfc38-f28d-4faf-9af7-2766a16dee1e", "sighting_of_ref": "indicator--e3f7f230-3d35-4191-ad64-ca5b37273180", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--065eb0c3-1e74-4b73-9bd0-a1f4d13f9778", "sighting_of_ref": "indicator--16f71f1f-3f64-4e57-ab52-7b29fe7ef8d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3843a57f-12ae-4dd1-a04b-8e9ee6082f41", "sighting_of_ref": "indicator--a4275f10-7ba7-494d-908f-a1e91d2341fc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7532128-3522-4c02-b03e-e0d42399ec96", "sighting_of_ref": "indicator--7f7052d9-8cac-4487-bb44-940dac24ff98", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52d3a427-227b-4744-9284-883683a8dcf5", "sighting_of_ref": "indicator--2bfefe26-d65a-47ab-b173-625d121dd357", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9b2dcde-84c8-4a83-add8-0a18b57feff0", "sighting_of_ref": "indicator--83ce74b5-ef1f-4a27-a27a-7cff91866dc7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d503ceb2-fb50-40f7-a313-325c3c8516dd", "sighting_of_ref": "indicator--f85a402d-55cf-404f-a48b-63be848433df", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61c78d4d-9064-439c-a1e5-524a9a880429", "sighting_of_ref": "indicator--12f6d255-ea44-4166-9e64-ffde47183d37", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f4435cf-eb01-4878-ac0b-a84d2a1bd51d", "sighting_of_ref": "indicator--fd7ded15-f914-4d64-b959-c454f81b3593", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5f88d19-5a22-4a5a-a848-a3b20fc31e6d", "sighting_of_ref": "indicator--5a5b91ec-bd73-4129-9630-074ed54fb7e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cc3c988-2b75-4434-9eed-53f7704f2201", "sighting_of_ref": "indicator--a0465913-73f8-40b7-a763-41778418300f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd14f331-235c-49fc-a4a4-16f92e990b46", "sighting_of_ref": "indicator--974c0b1e-f112-4e87-8c9c-a6eab51b34c8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e73e23f-9e3d-45e9-8505-d6a9c8b6d03a", "sighting_of_ref": "indicator--6fab2e1f-4907-45ee-bd7a-1a08ced1a986", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cff49539-afe2-43df-8d8d-8ff88c64b2e3", "sighting_of_ref": "indicator--0e611052-8879-45f5-bf12-c6138242df66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2756c770-b406-494b-9b59-1d5995ffeda4", "sighting_of_ref": "indicator--e8dbcb6c-b68d-4b0f-a4e4-3a6c43c32ec4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1d4b26f-34f4-48f1-8a75-b3d67d1c8e04", "sighting_of_ref": "indicator--96d14f15-9475-4139-82fd-fc221fb6ba23", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98fb5d24-d3b7-4bff-957c-14fb34fa2d25", "sighting_of_ref": "indicator--c9762cc3-b9cf-485d-997c-8c43c2f05907", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e15486f5-172f-4188-af00-7b0eb1df4a52", "sighting_of_ref": "indicator--3cf5727d-c929-4c3b-99d8-02117c86a94e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8fa8aa0-a26c-4a65-8d66-54d35b44b724", "sighting_of_ref": "indicator--21304874-be8c-4ac6-9831-bb26be7f82aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa375868-a04b-408d-84ba-b9988cd63a10", "sighting_of_ref": "indicator--9c5197d1-a5f2-45df-bc50-3055271ea1f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e27ea2e-a209-4f76-ba0a-230abf22a606", "sighting_of_ref": "indicator--fbbeaa9f-ad4c-4d66-8259-c0b1a112362e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab5031e-54cd-4c0a-8560-de24e0af5ce8", "sighting_of_ref": "indicator--d48b1ad2-0356-429b-ab16-8c9e8fb2c520", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8255b9db-d07f-4be0-8106-6920e296ef58", "sighting_of_ref": "indicator--ebeb349e-4836-4622-9346-5c57c52c2867", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17f6aa90-f40f-49e4-90a1-fd6ff6a671ab", "sighting_of_ref": "indicator--b8b60420-a48f-45ec-968f-2a212edfcad4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--612ea673-5df1-4148-b0c2-91657eb1ca98", "sighting_of_ref": "indicator--462c28a5-43d6-420a-9843-043ed1d85df4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--234d55da-684c-4665-a1f4-effd20ab333a", "sighting_of_ref": "indicator--ce4612d9-38a5-438a-a1d6-372c67647f78", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbfcc69d-5cfc-4fc5-b4e5-69a588aff687", "sighting_of_ref": "indicator--ab0d0571-2aa4-4b16-bdc2-010610bdf11e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--292e1033-51d7-4cad-9a7f-21fbf93eec42", "sighting_of_ref": "indicator--97d54ba9-5a25-4982-9aa5-f95b81d419ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c089750-c046-44df-bbcc-46159beb9785", "sighting_of_ref": "indicator--73f18328-d004-4b87-b314-179c2febe3c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28dc5d99-493a-460f-bbb6-b68d27ad46bb", "sighting_of_ref": "indicator--ddd4c9f0-a568-4aaf-b6d8-96ff51ddb621", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5211a999-1e33-4551-b908-db9777f0c497", "sighting_of_ref": "indicator--4584a97f-ae50-4051-b22e-84e5c4018197", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5835a72b-56bd-498f-8c19-88adf47e0695", "sighting_of_ref": "indicator--b16919ab-5d95-4dda-b16f-622cb14bdde5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4c0a7e4-0f24-478e-bf94-77349684a064", "sighting_of_ref": "indicator--4eecd236-dc19-47f3-a35b-05e47aae029c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4469be15-11e2-4238-b686-7b282a37803d", "sighting_of_ref": "indicator--7278d477-d8b8-4eda-870f-2bb3fe46b85a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0f32ab2-b6a8-48c0-b61a-d3fd351b63a6", "sighting_of_ref": "indicator--c2e0fc1a-9cd7-4c5d-8d3f-d3769e491dae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba904567-cbec-4963-bf46-a7b707d55d47", "sighting_of_ref": "indicator--7ad989ed-0f54-45f8-8e16-b3076a4074a7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e99b9512-042d-4eee-ae3c-3dae955879bd", "sighting_of_ref": "indicator--78731bdb-e67a-49ca-b9e5-c0dcff2d5d6b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e540d1bc-73fb-49ea-80b0-c31ec13bc3ec", "sighting_of_ref": "indicator--ecbab043-6ac5-4734-a1b1-f0682fda9f68", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1316e7ab-17cb-4305-8c4d-725149158e1b", "sighting_of_ref": "indicator--b1aa9502-c648-410e-912e-a23159c9bed7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb980edb-2ed6-4421-b3bb-7f540598e318", "sighting_of_ref": "indicator--cddf6fd5-a92e-4199-a0a6-53b13b1deb2e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa0339dd-84f8-4630-a8cf-07e8f24fcfc6", "sighting_of_ref": "indicator--ca40074a-0086-4c22-861c-b7182ddb4f48", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a23aecc-f781-4cfc-9079-8314667151fe", "sighting_of_ref": "indicator--f59f1b51-9011-45a8-b729-3995aadaf45e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1300fc5f-3071-45ae-a9ff-c97bdb9ad877", "sighting_of_ref": "indicator--bcb5f486-9efa-4659-b3f0-3ba129bd8d97", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a040e6ea-7059-48f5-9b0e-fb1021965cb3", "sighting_of_ref": "indicator--c5645e64-ce72-43d4-b9d1-29df76254f97", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff8c658e-098d-4afc-a6a4-9a02ccf62e7c", "sighting_of_ref": "indicator--562c0b9e-8c27-4bbe-80f1-3f68586ae9ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5016238-08ab-4229-a039-51b0e2a7fcb4", "sighting_of_ref": "indicator--8fae9d82-256b-44bd-9871-f025b5769c13", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9cb4a82-5099-4355-83d4-a36b385b31ba", "sighting_of_ref": "indicator--a74b0919-0fcf-490a-883e-a6cd2519cb6b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b67f7e9c-f46d-4d12-a423-cc5e535235c3", "sighting_of_ref": "indicator--03f1568d-24fc-40e2-9822-8165031567c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04054881-234b-4a7b-8be6-613f03f8b093", "sighting_of_ref": "indicator--4e3e24be-5dc3-4165-a302-48aaf27c97ee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d69a083-f979-49dd-83bb-56069da7155a", "sighting_of_ref": "indicator--623d680d-7e91-4d7c-a3a6-ec0dc3a00b56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82fc4b04-4e87-49e0-9a77-f0c8216bcd58", "sighting_of_ref": "indicator--5df38765-71a8-4080-87f4-988aafdfe1cb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b5e3ab-d8ea-41c0-b8be-a7c7a2b22829", "sighting_of_ref": "indicator--b9d2e924-1f2e-489f-918b-25fe48a8e259", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df20d865-6b2a-4047-8194-86c2aef18722", "sighting_of_ref": "indicator--b20e1d55-c33a-40d7-86fb-a0c384f4de7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d272d9a-4335-41ff-a66d-abc93e838ffe", "sighting_of_ref": "indicator--7554d083-b048-4d95-8bfc-25c290c2df39", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8714c1f8-3586-4b46-b202-5daa0f19173a", "sighting_of_ref": "indicator--55e3bfc4-fb8d-48a3-b0ef-4187dfd2ee52", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4deda307-3356-4726-bf8a-273792e8607c", "sighting_of_ref": "indicator--46744ca2-180e-452a-9ef3-43fbaf9f10b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--577baf50-0c5a-4b1c-a6fa-6d8f5d146f5f", "sighting_of_ref": "indicator--0a62e6c4-5659-4547-b62a-369fafd0e86d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce34cd82-4960-4086-b845-f11632c91116", "sighting_of_ref": "indicator--a9e7198e-a20f-45ba-93ab-fbdea0ff0129", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--543e2abd-835c-4227-a75b-1a03ea4b3a59", "sighting_of_ref": "indicator--deda0ae3-06c3-4e09-9836-7c501f8d517e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ae1bb03-9d9f-4b72-9471-d1db73402f6a", "sighting_of_ref": "indicator--f40f057d-2f22-4d29-9e63-469eee3b969e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4dbc8e-19fb-4e83-a727-cc0063c0ea12", "sighting_of_ref": "indicator--77117eb4-a914-40e0-85fd-3323ef9f1fda", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--006b1ffe-08cf-413b-a3b6-27480f6acf92", "sighting_of_ref": "indicator--98e02910-1bfb-4fe4-853f-f9b6ad996b71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a5dd250-7677-4f81-a91e-9231894cde9c", "sighting_of_ref": "indicator--c8c181a4-b0e1-4d01-b213-267c92f74ab5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb6f4209-3e60-44bf-a400-d58da9eb5c54", "sighting_of_ref": "indicator--74395fd1-b37f-4a1b-999d-f88429aa89fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3108a7d2-5982-4171-a661-76eca1bcc74b", "sighting_of_ref": "indicator--09658e91-8794-40df-940d-04c1f2987415", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de66d377-1de5-4b1f-a396-c89fcd4144f1", "sighting_of_ref": "indicator--31843d47-a2ee-4018-b1d9-1607471dbc19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccaa0fcd-5657-4e87-b8b6-26ab682c0da2", "sighting_of_ref": "indicator--6b4b2302-20fe-4c75-b55a-7674fce9de7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d9bdedc-473c-4d82-a609-ab3ff3294873", "sighting_of_ref": "indicator--af189c33-bce8-4171-80b2-2d455817bb70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beab155a-6008-4de5-9fb5-6df3d8e9c7d0", "sighting_of_ref": "indicator--95cb8541-9463-43f7-82e0-2e3d1a22244e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a558255-d439-48bb-a2ee-79b28dc09d9c", "sighting_of_ref": "indicator--72d13350-91f1-4b58-8583-0d782cf5ed1c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acab9664-9cbb-45aa-9a2f-7ce7adfec272", "sighting_of_ref": "indicator--dfded4b9-89c6-421b-a025-7c11be42d158", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cd8abf3-4da6-4e2c-99da-13bdfe3436ba", "sighting_of_ref": "indicator--b36344b6-155f-4379-9f96-e10d920d434b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dad43d68-9173-46f6-9e7e-af1f6fa63601", "sighting_of_ref": "indicator--c7536747-8584-46bb-b9d1-9d04879a9f53", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f3db2a8-4a4d-4407-99cd-31d85a0890c5", "sighting_of_ref": "indicator--a7a1cc37-642f-4d32-819d-f13e0ddd0644", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7f0fa7a-08fd-470a-add7-ecf623f2354f", "sighting_of_ref": "indicator--bf8774c1-383b-43bc-a564-8bde60d0d5d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be84c49d-fb3f-45d3-b616-7c7bbee8c6e7", "sighting_of_ref": "indicator--2ef0022d-9f90-4b55-9634-40f4fbc1bab2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8eaa56e-c8fc-43c9-b9ac-2bebbfce678b", "sighting_of_ref": "indicator--56da55f5-04bd-473e-92da-cb9160327ce6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--620e6df8-2a8d-4066-86ee-89167245f3c0", "sighting_of_ref": "indicator--145481e1-951f-4cc9-85de-b34ef100ec09", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6fe5664-6105-4555-bb27-ca0f3251cbcb", "sighting_of_ref": "indicator--c74d90bd-52f6-426d-980d-b9b9c8099587", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49ee452e-8bf2-453b-9578-e6948ea61c83", "sighting_of_ref": "indicator--60e57435-bb4f-476e-8e7a-36514fadcdcb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de490df3-ed1b-481e-9342-0386ec139519", "sighting_of_ref": "indicator--44f3312a-17b8-471a-ae42-101c29b2e851", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ef62af6-6c5d-423b-afe5-093726adad27", "sighting_of_ref": "indicator--e031a0ba-c3b0-49bc-9bac-e09062bd9527", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c30ac978-aeb5-442a-8faf-3aa435cc38f9", "sighting_of_ref": "indicator--cda7eae7-2add-433d-aee6-6ff1670312ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1eb2927-bcf0-4520-9b7a-ee06d04ca2ec", "sighting_of_ref": "indicator--e671a4b9-6eb5-468a-884c-f7725ef940fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f29bac9a-8c80-4589-a297-cdef6fa15e4e", "sighting_of_ref": "indicator--30316204-a534-48a4-9350-bd8f30900a44", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc45a6d6-80b3-42df-a5e6-5a18799099c2", "sighting_of_ref": "indicator--a02285c8-1177-4dcf-a986-76c14c026c70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa40a38a-d00b-428b-9041-0958baac2a07", "sighting_of_ref": "indicator--0a137944-f601-4780-9139-914642ddfa61", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afcc8616-34fe-4c31-8912-921b077c3e69", "sighting_of_ref": "indicator--2852216d-8de1-4f47-b03e-07b35729dc1d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d6b5738-ce85-4c77-9a4f-24eb8fa6cdd3", "sighting_of_ref": "indicator--7fb0e5ae-46c7-448a-9ce1-b557bcd744bd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9044993a-4325-4eb6-a2d3-d8a47db0d15f", "sighting_of_ref": "indicator--824a26f6-2d81-4fc6-bbcc-f5c78e010604", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--932965d2-42a8-488b-9317-b0d5c12c2ce5", "sighting_of_ref": "indicator--298a3ede-f483-4ae6-8c04-7c372641b927", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--611b8121-2a9b-49d8-be62-d867d43f9413", "sighting_of_ref": "indicator--73ac64a3-7756-4587-bace-337d0e3958a3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d6da52-b764-4efd-9755-2cb3cb3fa6cc", "sighting_of_ref": "indicator--2f753ee1-0a14-4243-9408-dc875652a672", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14223043-97db-478d-8814-46f4ba9cc44d", "sighting_of_ref": "indicator--1a8f44f5-3c97-4827-9c83-848bf4f30924", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c374839-e549-4030-ae53-066f2e831108", "sighting_of_ref": "indicator--d4c53910-b8b3-4bb3-a56b-f4e6aaf0ea8b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--404c721b-3088-42f3-acc8-e69ca8ab0e52", "sighting_of_ref": "indicator--9cada7e8-5317-4f61-a1e5-7e53d335505f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab438fb2-2cfc-4acb-bbb7-895f5619e8e5", "sighting_of_ref": "indicator--0ce5a892-64fc-41b1-b732-c9fd09cca942", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--427235bd-e60c-4481-99aa-82a348209b5d", "sighting_of_ref": "indicator--7980f069-6b12-4f1c-a48a-ea67b1a7d766", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f3e3b92-e992-47dc-aadf-7caf0f20b384", "sighting_of_ref": "indicator--d2ccf340-f75f-4e06-904c-e0a7b5b822a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae6042aa-bca6-4120-8f8d-b7b3ba71593c", "sighting_of_ref": "indicator--a4910562-85ee-4191-84b3-6f734401455c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f1d74ad-2ebe-4eea-af25-0c45a787b997", "sighting_of_ref": "indicator--8b38ad51-6f09-4e8f-a2f9-be537703665d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c90c24c5-19d8-4240-993d-aef05d4a15dc", "sighting_of_ref": "indicator--6f6f2730-dd80-42b0-a23b-c4c09ba4ace6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c32a7548-3ca3-4cd5-8dbc-be859ae377f1", "sighting_of_ref": "indicator--cbffcf1b-9181-43df-a2a2-0c221020acde", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94a5fe2a-6b5f-4992-8117-601855594204", "sighting_of_ref": "indicator--4c312c81-8f0e-4f4a-bc77-df68697ead4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ed5ab0b-1109-4ab0-bf36-6b3149d59dcf", "sighting_of_ref": "indicator--262ebe9c-09b9-4a70-8707-3f43be218e78", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2de6dd49-e973-40de-a9d9-628216135293", "sighting_of_ref": "indicator--ba3f2dad-65c7-4f2b-bf14-4bf6083d003c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a78400df-9aa0-408e-b1cc-3ebe1de532f5", "sighting_of_ref": "indicator--ff878532-d051-4548-aaf9-e43eb4970c2d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feca6c4a-59e2-4dcc-a53e-1961790a1f6b", "sighting_of_ref": "indicator--324e5e16-42a6-4de0-b90e-9676d6147341", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--600dc178-4b4f-4583-a615-ed986eff1820", "sighting_of_ref": "indicator--23a96b64-c816-461f-be67-8824262dce3e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ac01491-d7f6-444b-a880-9cd0c4fb73b9", "sighting_of_ref": "indicator--b64d314d-821d-4e80-b7c8-8c8be08f6872", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcf0f1e6-233a-420b-954d-cf2f61c9d214", "sighting_of_ref": "indicator--96910675-e0b9-40af-86c2-8b2ed50c3158", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--768600eb-999d-4c6f-8774-fb5819c86c2a", "sighting_of_ref": "indicator--38632413-fb14-45b5-9f41-6c29dc2e698b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a54fd58e-e180-4595-8229-f82f82e0638d", "sighting_of_ref": "indicator--1b6cdf5c-5bb8-420b-87a9-6cad2db914d2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af6eccfc-e91f-4f07-81bc-700d62779290", "sighting_of_ref": "indicator--171c6c18-7fdc-46b0-98f3-9da30c07aefc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4238bf09-5793-4409-a783-cacdca922d93", "sighting_of_ref": "indicator--5479cbe3-c1cb-40d1-abef-cebce50770f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d01df4-6449-4d27-97fe-a7036fb2a63e", "sighting_of_ref": "indicator--38810c97-f4b1-44a9-aac3-c3b794a46d5a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af93d9af-34a1-4389-824a-77da1653deaa", "sighting_of_ref": "indicator--70ffbb80-b81e-4ff1-a389-3c229d1f9ad0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54bff95b-7b09-4976-9b03-0e4083d27796", "sighting_of_ref": "indicator--c2c5f52e-eef7-4d9a-ba0c-7d79e7fa90a5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539b8177-a1eb-41b9-894d-94cf2854f577", "sighting_of_ref": "indicator--375e184c-a95f-4c39-bdc9-84e601cbca47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad66969d-cbc2-4d26-99f5-debf72ceceb1", "sighting_of_ref": "indicator--8d317147-bb05-41a8-be1b-b796668df926", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c13e066-921d-4876-86b6-6bd3bf57982c", "sighting_of_ref": "indicator--a59bd62b-1e62-45a0-a183-ac66f4c9402a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1961b11a-c3d8-4590-88b1-5eb501021070", "sighting_of_ref": "indicator--f0f7db13-5605-487c-9e58-9d0661dca551", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f35340f4-2566-4d7a-8522-bf56f3cb8332", "sighting_of_ref": "indicator--71a5cf39-622b-47b1-a7ec-287dea33a98f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bc483dd-74c0-4bd6-ac27-249ed9369fd9", "sighting_of_ref": "indicator--1f892edc-8fcc-4623-96fc-23d338c9d138", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf801920-61ed-4c33-a2da-d02356004602", "sighting_of_ref": "indicator--337673d9-f64f-4651-9020-928875de7aef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3772b5e0-b22f-453a-b5a0-137898653f9b", "sighting_of_ref": "indicator--ad3464be-6c06-4f5d-b00a-2d18a0695ed4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eaa9168-4bca-4736-abce-e07b3491faa3", "sighting_of_ref": "indicator--7bcee098-4e07-40d3-8e99-e766bf518294", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5a5a0ea-0b7f-4b84-b36b-9155ff456da7", "sighting_of_ref": "indicator--7b6340b2-aa25-4fe6-ae7f-280f3b2fc25a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f94f0b2-c6ba-4379-964f-2e620d34a979", "sighting_of_ref": "indicator--5f6a7219-af3c-4ea2-8407-b18432ea0313", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c735526-0f1f-40aa-ac99-225697b4f253", "sighting_of_ref": "indicator--0b36f693-2a49-494e-9ea3-fecf2b8365b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--383e4e24-24f1-4552-a3a0-e5ef947921c6", "sighting_of_ref": "indicator--5e604bc2-57d7-439b-8e2f-36847e68a6e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4565a5e-072b-43d7-b44e-e1ebb13f1099", "sighting_of_ref": "indicator--e8c783ab-e154-4631-b530-01ac919171ce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e54907ee-aad4-48e9-9883-ac38062be16c", "sighting_of_ref": "indicator--02c84579-fc71-46d3-b834-cbba2a0d6601", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--974e99e1-bd1a-4af9-874f-ec505ace62cd", "sighting_of_ref": "indicator--f787f4e4-c287-412c-bf3c-8e7731cfe4c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93990590-e051-43dc-87c5-b26765047a61", "sighting_of_ref": "indicator--ae3d1bd0-83ab-4990-bbc6-98acd4f7a789", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2337d6c8-2d71-4f80-8afc-f5330a7ad461", "sighting_of_ref": "indicator--45eb91a8-caf9-42a7-a30a-620270a286cb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f16959e-1c3b-4053-8a3d-f3bdfa873928", "sighting_of_ref": "indicator--fd644e0b-c3c0-45b1-a61e-c939d4de4c1e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2f871dc-f9c8-4486-8cc6-3d426c77ece6", "sighting_of_ref": "indicator--4c6192c7-acf8-44c8-94a7-5ad44d1352ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f9a6f7d-d541-42b7-90f7-23f56ce7b207", "sighting_of_ref": "indicator--393efafa-66b5-4c60-8afa-6af3abbcfb5f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9d63dc0-a095-4c4f-ac26-08bd7b9257d9", "sighting_of_ref": "indicator--9cc82636-eb0c-452c-9f00-437f44cca8e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--132f0bc3-e49f-4267-adfc-86ecba9ffe26", "sighting_of_ref": "indicator--fb3c51e4-cfe2-4881-9fd3-0a1888029d7a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b273287a-2b98-4e73-af0c-499f3d206d21", "sighting_of_ref": "indicator--a7c302e0-c99e-485f-9d77-a74725f7d6cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2148f0c4-02dc-4568-8d97-d731d8c6441b", "sighting_of_ref": "indicator--dc357728-3c34-442e-beaa-ad7407a9152d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2871a636-7514-47d1-ab7c-e63d67233271", "sighting_of_ref": "indicator--06542efc-54d7-44bd-a188-863e58d4e694", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6326f50c-c356-4c8b-ae83-98418e390b0a", "sighting_of_ref": "indicator--5d143d56-e7f5-443d-9b65-b40b5d0e8e67", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fbd5963-9bdc-49bd-929c-a80f915840f3", "sighting_of_ref": "indicator--6f3228d6-d01e-4450-bba8-54fc866213b4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65bf67db-74b9-4586-8952-609ce0f42921", "sighting_of_ref": "indicator--90d05d7e-f230-43f3-8af9-10506fe94c83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65d42e46-1e73-4ce4-9d73-5845322ad258", "sighting_of_ref": "indicator--67738b48-5807-4e40-b9e2-cbf949423ffc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b102c68-daaa-405d-830c-e24cf8b10a82", "sighting_of_ref": "indicator--facc7adf-bc01-4e96-8434-be689411ee00", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36e25181-4b66-4661-8082-037943dbf65b", "sighting_of_ref": "indicator--01f34261-9fcf-441b-9ce8-3bc7fbfad335", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--418fc85b-0426-4d78-93a9-9cd63de6748b", "sighting_of_ref": "indicator--50255ed1-d2cd-4cf4-a06d-c277987d4580", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d77115-8016-40a3-856d-9c0a00cc237d", "sighting_of_ref": "indicator--9b8367b4-2e68-41f9-857b-54535cec24c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--818d0090-ae71-441b-8cd9-f4b9f6594c7e", "sighting_of_ref": "indicator--b20590c0-dd87-491e-abc5-81631b20bff1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c892437-d447-4c49-a4ac-18fb9ba9d829", "sighting_of_ref": "indicator--1e872fe5-07ad-4913-b519-e945e314f082", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5f9c683-399f-477b-831d-319f91fccf4c", "sighting_of_ref": "indicator--3d04e208-314f-41fb-a1bb-15f7be2c6564", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb891cdb-fe11-4b36-b761-54bb533bcffd", "sighting_of_ref": "indicator--dc7ce702-0fba-49b0-813f-d7dc00910563", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9afa3787-bf21-4e53-bc36-7d8857f92926", "sighting_of_ref": "indicator--7a7ba87a-7885-4429-b905-b90b3c2f48a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--503f6ee3-e5c3-4395-af2c-1c0f719f864b", "sighting_of_ref": "indicator--98cc4179-9c60-4952-adb5-65be9e1db710", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94007eec-eb41-4e3b-89f9-bcba1554254b", "sighting_of_ref": "indicator--98274255-9721-4348-9009-d7377d8ff1c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f92c63a6-22af-48d7-885d-bf1c7ed5599b", "sighting_of_ref": "indicator--b143ebc4-7af9-4079-b256-b00c8c48e1d7", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2337f8d-928e-4dcf-878f-028544c75d1b", "sighting_of_ref": "indicator--11328b8d-7027-48b5-801d-1f9259cba194", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--039e7435-cbf1-4c69-acaa-2f5a537fba84", "sighting_of_ref": "indicator--61639a9e-9ad9-4488-bbcb-023065f887c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90592490-9574-456c-9ff0-2157ccd7b501", "sighting_of_ref": "indicator--e3d48d87-27ba-416d-b86c-a2bb30c6e302", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e3bd86-40dc-47b7-b209-940941ff1f98", "sighting_of_ref": "indicator--5e785684-f53b-4311-a7e9-689d229db836", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dc94401-9a06-447e-a335-e50ef3d5d72a", "sighting_of_ref": "indicator--8c681ce4-21e1-4c91-ac85-6ee342db4a71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a64a872e-ed24-41ec-b8f0-5ed1aa7e1b22", "sighting_of_ref": "indicator--a66d2a7b-e120-48b9-8c0e-727c52070d1d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77051ed0-4c0b-47f2-9531-956737fea9da", "sighting_of_ref": "indicator--3685d5f1-207b-4b9f-90ab-ff5ddf052915", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db50944a-040d-412b-bf05-eacabbf646f9", "sighting_of_ref": "indicator--52e9ed6b-3ae9-4829-808c-5281ac031cc7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a60a35fc-2323-4ae8-b602-994a897c6c67", "sighting_of_ref": "indicator--47d4511d-4535-4ebc-b11d-c83c5edd0e3c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea6fcd02-04ee-4cdd-9999-683a039383a9", "sighting_of_ref": "indicator--d80c1154-417d-4bc2-8a89-9f8e75c0e0aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5104d530-20de-4f2e-885d-927ad1dea525", "sighting_of_ref": "indicator--c6f2045d-1de0-4d4b-8afd-ab81cddd7dcf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cc0158a-5c65-4476-9c38-4201589349c6", "sighting_of_ref": "indicator--da341820-d9b9-4398-ab98-afdb1515cb1d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9c70c6e-803e-43a7-b69c-c1e982fdf4cb", "sighting_of_ref": "indicator--bbf26440-5458-423c-a6eb-9634c0eaa8d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--210de0ed-56af-4988-8d56-9aa34cff9184", "sighting_of_ref": "indicator--e89d3ed2-a0da-4861-8ba9-118b297e903c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23beeddd-c661-4b4e-99fb-f5947b1ba996", "sighting_of_ref": "indicator--7747801a-206a-4635-9739-4834ff9f0b1f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e507fb6-84c8-4826-a103-92365d2c7368", "sighting_of_ref": "indicator--8fa234de-3c3b-4fa2-ace9-a9d7931f2f59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92b6886f-3cc6-4019-a3c1-93e9d464d474", "sighting_of_ref": "indicator--8f856be1-5049-4d96-bdd6-c90e14158887", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de4d4836-027c-4d73-8515-25fb8ce84363", "sighting_of_ref": "indicator--7a3a15f3-5048-49c0-a5a8-a9369c6629f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--594a43de-1e31-43c9-b29a-de7f2cdf60cf", "sighting_of_ref": "indicator--d4fbf309-e9ed-415a-a209-ae9d8c5e6c6c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f95e0d8d-3839-42fb-b65f-1f9a914faf85", "sighting_of_ref": "indicator--1b90b66c-6897-45e5-8f25-0c696fe7ac2f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--817d9f44-a8f2-4467-9962-a05bb2df4298", "sighting_of_ref": "indicator--82a244cd-6148-46e4-b054-ecea22136f15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e28a7875-00c7-4f99-babf-4185b2b70567", "sighting_of_ref": "indicator--f521d32f-5293-4b59-91e9-1432f83b2998", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33dc2ff6-9aac-4e9a-8c18-440c6be14019", "sighting_of_ref": "indicator--9a60301f-2c44-44c0-93d4-d9dc4573a0be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--361d2453-b86d-49e6-8078-fb965739a6f4", "sighting_of_ref": "indicator--5a643a8f-a0d9-4e69-ba27-f4a1d063dbbf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88c3cadd-201b-4f26-80fb-3d04d3aec678", "sighting_of_ref": "indicator--bb2d2160-de10-40e5-8fc8-d6ede2dc6d71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ae79543-5728-4448-b987-732334eb806e", "sighting_of_ref": "indicator--c1324ba9-b266-4fff-87cf-50a50eae52f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7f2f848-6a27-47f8-b08b-eb47cd73f673", "sighting_of_ref": "indicator--5f5dffcc-5384-48f0-9750-96e21bb71355", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e237127-3eb1-4ada-8f93-f9c625f5f705", "sighting_of_ref": "indicator--ff8401a6-f17e-422b-9850-774357cbee04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47352f1c-e868-4aa8-8387-e9ab3794f542", "sighting_of_ref": "indicator--fda4ae9d-2659-4223-a461-86612d7c5f36", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--367a5930-c880-4f81-935f-b723042a52a2", "sighting_of_ref": "indicator--2e40f768-f8ca-4d30-aca8-b3df511da315", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d0a719-e936-4aa0-9671-c2ad628175b0", "sighting_of_ref": "indicator--ee91bf9c-613c-41ad-a7b8-8b4d0d0ba889", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bac29ff1-88ae-4db7-9722-04cbf23a8171", "sighting_of_ref": "indicator--c80dfd0f-e91d-4f35-b313-3d7a7958c57b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9410e4be-6348-4e4b-a7c2-cc1c2d345969", "sighting_of_ref": "indicator--4d609456-7f53-4944-a98b-5b0ed79254e0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be54aa81-4040-41d6-8ac2-e55d6cccde4f", "sighting_of_ref": "indicator--3fe6ef8d-edf8-4784-bf94-bfc1a90507c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--300cc563-87bd-414f-9382-3d9628b9c2da", "sighting_of_ref": "indicator--02b662c2-417e-46b4-b2b0-1ea86c975b85", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd72187d-8c37-4ee3-9344-90b6afeefcbd", "sighting_of_ref": "indicator--deb053f0-869a-4463-bb0e-51731a533e95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ece52687-08be-45ac-b53c-56a1119a05a8", "sighting_of_ref": "indicator--0410b8aa-21b6-41bf-9bd4-8154f5ca0943", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa55bde7-896d-4d81-9798-24a3704ff42a", "sighting_of_ref": "indicator--74a8ac15-a697-4f7c-b5a1-cc7890327057", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b17b54f3-6e28-493c-b9b6-f1096d1111cb", "sighting_of_ref": "indicator--a673e246-b6a6-4420-a617-ec19fd1ce989", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d963e20-8516-47b4-b58e-1cc2e9a23e6e", "sighting_of_ref": "indicator--851e5548-3d85-4f89-9eb0-1b0df5db4f14", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5963447-34c4-45f9-8d9f-a2a14bf72a0e", "sighting_of_ref": "indicator--8f23e8d6-eba5-4dc1-a19e-f28d6be63db3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec264a5b-673e-4b6e-806e-24b0278e7596", "sighting_of_ref": "indicator--4f887e91-fd5b-4283-8f2e-3f11b933af89", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cce7f00-3277-477c-9ddb-f9b738512d14", "sighting_of_ref": "indicator--e5eef1ab-d294-44f2-9d30-d801200e01d6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--198f7dc8-a3cb-4e31-8bff-ea98ebaf069d", "sighting_of_ref": "indicator--c535cfe6-f8c1-4563-b193-d2f7c631e934", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d28be7-f864-4f0a-8a8e-024e9fba9198", "sighting_of_ref": "indicator--c535cfe6-f8c1-4563-b193-d2f7c631e934", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eef4404-4a75-4d4f-8b8f-bbb1f9b270dc", "sighting_of_ref": "indicator--a7f30c52-5027-4728-9549-1e80452c7851", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fbf3977-0ccb-4704-96c8-31e502726354", "sighting_of_ref": "indicator--77fc24d9-911e-433f-a19b-c7decf68bd30", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--032257b5-f0e5-4d67-bc18-85ca6e6a8924", "sighting_of_ref": "indicator--e660f68b-bdbb-4e2c-b510-a31b0e7aa6cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c06d6d78-0a20-4813-8c0a-507b22b0fbb8", "sighting_of_ref": "indicator--9ca9aff1-b3cf-4e89-a81f-f75e4c0bde71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d0455be-d369-4842-8c08-8b974e300ec1", "sighting_of_ref": "indicator--da1d5cf9-f7a5-4f2d-92d3-ae9358199ff9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c58f2798-f0ef-4b2c-914c-9b35c4c094b4", "sighting_of_ref": "indicator--bb6b4838-2d0f-44b3-8444-fed4d6354f07", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a566127a-ebae-4241-96cc-c4e2421e007e", "sighting_of_ref": "indicator--c30f4047-0ea2-4d18-8812-9dd234227533", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80416926-8201-4a9f-a285-f7dcd1ed0e76", "sighting_of_ref": "indicator--8116ba9b-5f0c-4ae7-89f7-f54d7dc3d68c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48d88f2a-296d-4e05-aa4d-cbe3f33a5dd7", "sighting_of_ref": "indicator--47aae697-7435-4d42-bf50-65c590fb86e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7025f9a8-6391-43da-9a45-7f093ad9d785", "sighting_of_ref": "indicator--ce7e62a2-35b6-4791-b939-6155d24d5fcb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c3ac280-7e49-4a0e-9f34-5561b21025fc", "sighting_of_ref": "indicator--ad659a32-a6dd-4776-b53c-50a664e61ec7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abcb40f9-04dd-41c3-907e-1df33746506f", "sighting_of_ref": "indicator--77188456-7ae2-48d7-b718-0aa6d4684e56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78ca548f-c9f6-48ad-aac6-92cae276ca80", "sighting_of_ref": "indicator--438900c4-e21f-46bd-9d38-1a2acf41b694", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d045e04-8b2d-49f4-8818-1d050b525e89", "sighting_of_ref": "indicator--4c240f97-b02c-4c02-85db-99de96a61359", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf6aa39d-a00f-484f-a932-b2bfac24560b", "sighting_of_ref": "indicator--d2fb28db-3a8a-41dd-8462-67e5450b1ae6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--303b50d7-16b1-4233-add9-013082916666", "sighting_of_ref": "indicator--3a1d044c-b0bd-4e9d-a408-12a94b995355", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbbb7c1d-7fd7-4cf3-8483-87c539329edc", "sighting_of_ref": "indicator--5f37d2e5-3a80-42b7-8a0d-8188c7d9424b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe17ba06-3a52-4b0e-a9f0-e888aaf5c2e0", "sighting_of_ref": "indicator--3fbb2d66-212b-484e-8407-4a58a56c4314", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dec5e8f1-a373-4542-bec4-5d294f7848f6", "sighting_of_ref": "indicator--183c736d-21ca-4a46-9342-8d3ddedd4a5d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dd4ec0c-c519-4d32-a3f3-2c572a6fa402", "sighting_of_ref": "indicator--e99736cc-ffd4-41b6-bc0c-f281d776fb0d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd6830d7-8290-4de0-9461-abea148caf79", "sighting_of_ref": "indicator--d893b894-c337-428b-b35e-cb761cde5d55", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3479ed8a-cef6-422d-989e-30180aee63e0", "sighting_of_ref": "indicator--074f7b7a-485a-4f82-9886-aac8f8eefbf1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d84a570-2e72-40cc-8799-7e7ffd4d55c4", "sighting_of_ref": "indicator--f7254ae3-84ed-4752-bb02-d4d8638172b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70224779-d3e3-469f-a83b-fd74ef91931c", "sighting_of_ref": "indicator--9aabe217-c57d-4c7d-a3af-d6857b2ee4e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--569e1d24-37e2-451b-a3e1-3c877c923b1f", "sighting_of_ref": "indicator--aaa3181a-6ce3-4e25-9786-d280e8f59f81", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44216c8d-af49-4397-beb2-77a1b1db0151", "sighting_of_ref": "indicator--a5341928-11e6-42b9-ae3c-38caedabfe56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1f6ef1c-f2bf-434a-8c60-f8a13eaa082c", "sighting_of_ref": "indicator--426c7256-eeb2-4ae5-b60d-064e7f53b964", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e73b3fe4-6d08-49ec-ad47-26e7572d4cc1", "sighting_of_ref": "indicator--acd42d73-9c8f-4643-a04a-6ca4a679b29a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec49fa87-6fb9-4a5e-bc3b-c0469e74fc61", "sighting_of_ref": "indicator--6d47100b-9206-482a-bc36-4da035be175e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a53a0fed-1622-4ebc-bee0-1ee72e5ac7dc", "sighting_of_ref": "indicator--78c2f2ce-3e7a-453f-9858-4d7dc323b55c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92a4842d-0fce-4c52-9a4b-57c0b9535ed1", "sighting_of_ref": "indicator--efbb101b-9c8b-4746-b621-a37c5d912e43", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e3ea780-3b57-4fc2-b818-17f7c9a84645", "sighting_of_ref": "indicator--f2302074-fa3c-4bb1-bdba-188841f05696", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecd497cf-f6b4-4baa-ba23-0ec8494e7b25", "sighting_of_ref": "indicator--ef36ba7e-9a8c-4b4f-a66a-e4cd3ec1ae97", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f43a2983-737f-45d2-9510-30c23747ee44", "sighting_of_ref": "indicator--1f1eee08-b3aa-4c7f-9209-be56fe908467", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f9f96ed-88c6-450a-981b-bac500939183", "sighting_of_ref": "indicator--18a2ac52-b10a-470f-8114-a2498371a81c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8504c9f5-6152-4e7d-a23c-db5b9d25e10a", "sighting_of_ref": "indicator--144429a4-b9fa-4128-861d-ed1afc35eea7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b2372f7-88bc-4834-885e-f8151e793a63", "sighting_of_ref": "indicator--8066e2cb-1fb1-4afc-9b22-b15ac06c9db9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ce3b75a-8dad-4b79-afb9-d6c36d1be3c5", "sighting_of_ref": "indicator--affbec73-8376-40ba-b80b-f0c93affe6cf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3756dd3e-310d-484c-9a75-bec809c8a660", "sighting_of_ref": "indicator--2e12d74f-047d-4239-9fe3-d8558dde0295", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3059c1a-818d-4282-b98f-c63820dff07e", "sighting_of_ref": "indicator--d9d10760-2fe5-44d5-b5c0-03412ceda53e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4977140d-343f-4d69-a0a6-9362d5554063", "sighting_of_ref": "indicator--24c5725f-1359-41cf-bcae-6d434df0502f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--284352ba-9e7e-4e9f-8008-1735e343ee9c", "sighting_of_ref": "indicator--87052395-9087-4e76-a6c6-0e2b2201e81c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--928215cd-bdc5-46a3-b8ca-8c42ac295e66", "sighting_of_ref": "indicator--4aca49f9-fc28-41d3-81aa-c6847a9ec7da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfd03516-e72f-424b-a202-0f9363cd8aa3", "sighting_of_ref": "indicator--461d2bfc-14e9-4d5d-aced-ed49da7d150b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42957d37-ea7f-4a53-921b-8ca8245699f9", "sighting_of_ref": "indicator--8d52949b-1d56-4adb-bb71-7ece4dac402a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f524a5ce-fcc4-45f9-ba76-d271caa80457", "sighting_of_ref": "indicator--cfcc4ca4-f352-4402-9248-9914f18a3e47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e96ece4-5dfc-4363-b1e0-795830ff3a02", "sighting_of_ref": "indicator--b926de67-1adb-41de-a481-e0a00925e653", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b6602ff-12b2-4e04-a903-443b96b7e9fb", "sighting_of_ref": "indicator--a0b7d801-be2f-4205-aff1-38a0cf5a0b2c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a6d5869-6844-4b9b-9316-65a013ae5b08", "sighting_of_ref": "indicator--54ca9306-7da5-4df0-bb83-75838589039b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72a8fad7-4212-4680-8e37-d8df31789839", "sighting_of_ref": "indicator--b6bc8aae-a714-4ba9-9515-470b7f31b27e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afc37436-a4ba-472d-a88e-1335984a049f", "sighting_of_ref": "indicator--540c102f-bfd0-40a1-8a88-502618f1b99d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78a464b6-8ed5-4d83-9e69-0388169e0412", "sighting_of_ref": "indicator--2ef55cac-12a2-4ca5-af4c-521d2b5c0b8e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--120b9b3a-66d5-4ac9-b9b1-d94344215cbf", "sighting_of_ref": "indicator--547ba0d0-4353-4b8a-8eb7-b261cff8860b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4918b2b6-b6de-4909-a5e2-fd1a47de391f", "sighting_of_ref": "indicator--d145b293-61fb-459e-9b74-60e31b49f241", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab51e606-5023-4eaf-b120-1ba5d86541f3", "sighting_of_ref": "indicator--9e24ac01-8d68-457a-b6ce-058e47104514", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7034c5ac-a160-4a0a-a248-2921f36f648c", "sighting_of_ref": "indicator--51de3d98-d55c-4b6f-8fe1-7c9800752967", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e80eeb2-71fe-4756-87c1-195ba6ea9ff2", "sighting_of_ref": "indicator--c8cb2dcb-c6a3-4449-baed-206a6167aba6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7b77a09-3f21-46ea-bfe1-b82c015715e6", "sighting_of_ref": "indicator--bf8ec240-4815-496d-9a3d-37afeb2f1e25", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ee52b7e-bf88-45e7-8c7c-af2225a0eca6", "sighting_of_ref": "indicator--f0c6f6a6-054a-4cc5-b370-dc3030bd8fee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42c8b326-6c64-411e-997d-a74f295514d3", "sighting_of_ref": "indicator--b00d305f-9b12-497f-ba3e-50d2ec11f487", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae21ebe1-ad81-4607-82c2-e548d0c72cca", "sighting_of_ref": "indicator--c0528f54-a84d-4cb4-b364-6be187b99474", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d24cac4-be93-42b8-bded-598fa1c0b6c0", "sighting_of_ref": "indicator--5e7b0496-e382-4ea9-a6d1-7940f7f73559", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36ab378f-3277-4b8a-a51d-4427b69dfc45", "sighting_of_ref": "indicator--4e35ef29-738f-4880-9d83-6af2ef79a154", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fd140d1-dd7b-4dca-b486-118ec4fd1570", "sighting_of_ref": "indicator--10ef432e-40c9-43b9-843f-347cdd323176", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc8e8e55-f69b-409c-a392-88205e72cfba", "sighting_of_ref": "indicator--764fb6c5-dcfd-4576-abaa-939188bd4a44", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dd7ce61-a4f2-486e-ad5a-c6add273e24c", "sighting_of_ref": "indicator--28a1f7b8-a1dd-47e7-87e2-0683dcdd3545", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43c9e0ed-7e35-4717-a8c7-174b7a5fb066", "sighting_of_ref": "indicator--f9bc415b-8798-4634-b3b5-8d19b2f55acd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--addaf33a-09ed-449b-ade4-1bee70dbb64d", "sighting_of_ref": "indicator--3377157d-70d2-4a65-9194-74668906cec5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bbfb2d2-a87e-449f-83bf-dac5316ad55e", "sighting_of_ref": "indicator--6c00881e-f35a-48d7-b07f-2e24256784c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b14643e-81f7-4885-9925-4a2e2cba66ee", "sighting_of_ref": "indicator--0d696cd5-3c03-4103-9620-a702d6bbdec1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05491033-8fc8-49a0-bf9f-5bc090dd2bfc", "sighting_of_ref": "indicator--a80a0f06-c397-4b70-b683-149d6cda186c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e73224b8-0052-485d-ad97-d34103f7a969", "sighting_of_ref": "indicator--87f35224-83da-4836-a521-f14a9ced1286", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4ca36d4-3696-4796-9a7c-329a555cd300", "sighting_of_ref": "indicator--c31aeb32-5c1b-4061-97ce-cf4a72d991c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--717fd9c7-9abe-4c57-83e0-99e8ee7c07fb", "sighting_of_ref": "indicator--44a3ff41-475b-43df-bf5b-06af22471151", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7986d796-fbd7-443e-9c6c-90fd0aa770c0", "sighting_of_ref": "indicator--8ed87e82-aa1d-4c7f-bb26-c796a460df41", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4631549-e87e-408a-bb75-1c066c61a5bf", "sighting_of_ref": "indicator--1403193d-3d64-4fa1-b760-ab24d0a8e7e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31211e57-e5b6-4121-a26e-2f4ca51e0e5c", "sighting_of_ref": "indicator--e4bd43e7-7785-4370-99d8-f272d25e0cc7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f190e4b-4b16-498a-9fee-d7a7e6aafcdf", "sighting_of_ref": "indicator--f43a8d91-76bd-4920-b03c-ed179b33d1ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a9d757b-23ae-4977-8359-39241f44437f", "sighting_of_ref": "indicator--30011373-8388-4de8-a1dd-6f8248e5aad2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc6307aa-2975-4ffa-8b63-b058f323f76a", "sighting_of_ref": "indicator--ec16e51b-c985-4412-a0d2-f623ddc8d15c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34ee6bff-033a-450b-bee1-9d7a9d16d21b", "sighting_of_ref": "indicator--5bf86ea8-7aa8-4eef-9d6e-7dd9242d666b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36a7c596-28b0-4b6f-89f8-81856f8d2fe2", "sighting_of_ref": "indicator--7cf85a5f-b45c-4e6a-8c35-7d6491db97d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b90bc67c-cdd0-4f83-814a-1783ac4c05fe", "sighting_of_ref": "indicator--f819458f-ad2a-4b6a-bd33-bed228a00e41", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20f52024-3f97-432d-9d4e-71f5b12c5bff", "sighting_of_ref": "indicator--e7d35862-880a-4749-bdda-fc800180938e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f63d398e-e417-4bb3-b453-2b648967ddd3", "sighting_of_ref": "indicator--be87bc77-da6c-45ab-93c0-c3e27a32d6bd", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--439a5e1a-7544-497d-a146-f9c758c7ad6c", "sighting_of_ref": "indicator--88ce8ce2-c545-4a7d-8c86-73d38f2b6c1a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85ed9232-3533-46ed-9ed9-98b2092caf88", "sighting_of_ref": "indicator--40978a70-d4b4-4ae0-b253-2740c84da8b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4cde341-7959-47c7-8ec9-447c06eb16b6", "sighting_of_ref": "indicator--d2da7d74-2a4e-4ce0-b949-579c9f6b07d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3fc5e66-4cc1-4e1b-b2bf-795d67257903", "sighting_of_ref": "indicator--8743bf02-d402-417f-be81-902c4914451e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff5b7523-b966-4d39-b925-fb5789761df1", "sighting_of_ref": "indicator--76b0e95e-42fd-4213-ac73-2673696a0c1d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4408f512-f219-4831-a545-b36aa399bac3", "sighting_of_ref": "indicator--dbc95aef-fda8-4098-88c2-c91fa2776b61", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--113478c9-a02d-47ad-b7db-bc763adadaea", "sighting_of_ref": "indicator--7be8a1ca-6c5f-432d-b3ed-5dfc46b11d44", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e7a40dd-e291-4ad9-be46-d339b44dbc49", "sighting_of_ref": "indicator--fd4029a7-d10f-48b0-843e-f7021ee2826b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9ed33f2-0cb2-4957-b549-7f9b76b81c58", "sighting_of_ref": "indicator--def4083c-fa04-4551-9a72-8bc136c4955b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c675311-528d-4348-ade7-7f7a6fade2fa", "sighting_of_ref": "indicator--b90a38dc-5752-4c2b-ac68-58df9e65b17d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cae107d-bd5a-497a-b639-f4925cae7a33", "sighting_of_ref": "indicator--ce9964e1-f3ef-43e6-ab0d-821e5138bced", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7363940e-242a-4126-b8af-4f8e4b103702", "sighting_of_ref": "indicator--b2bf1b09-2e1d-4542-84bf-9d32463cb4d2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c9d0908-f10f-4da3-b5ad-4dc7face4585", "sighting_of_ref": "indicator--414a31c0-5344-4265-ad48-8470a0dd7938", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c8a788-0d31-461e-95c9-0d73bcea374f", "sighting_of_ref": "indicator--32a200ea-76cc-46c4-844d-37f64f03a408", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55a5095b-be26-44fe-ad54-c7ba7d99cb07", "sighting_of_ref": "indicator--cab06552-53d3-4df3-bce4-fe0dfde73821", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--328332cf-fcd7-461a-8843-1a76a9a08d16", "sighting_of_ref": "indicator--5a84149b-357d-4706-9dcf-06ff33a7331b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d811abaa-9a71-4f68-9215-22575b6bb97c", "sighting_of_ref": "indicator--49370197-c830-4e11-8b92-ee3d3a7ca0b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bd9c0ed-fac8-42d6-81d4-cebc422e998c", "sighting_of_ref": "indicator--a5146e0b-853d-48b2-8932-efe5343a42c1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeb23054-f52d-4465-ab3c-0192edd3df1c", "sighting_of_ref": "indicator--8941eae9-0627-4188-beaf-73e73e7ed138", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57a8db0d-7fe1-4b4c-ac48-d083264fa93a", "sighting_of_ref": "indicator--f7698de8-f603-4c5d-8a26-adaea4ee3ab8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eacaed7d-d92d-4f26-ae21-9bbf63875471", "sighting_of_ref": "indicator--b54bd36c-05fb-4a94-a41e-c34934e51fe3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99184885-195d-41d4-b3b0-2dd5361a0ef6", "sighting_of_ref": "indicator--9e474a71-fe86-4b62-bd0b-0eed5d26ea1a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--769447d6-5bdf-4cc2-892b-6c841cfc2866", "sighting_of_ref": "indicator--bb0bf104-b400-4bbc-a9b5-3fda375b3421", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--194852a7-c57a-47ea-98cb-73df374e1c80", "sighting_of_ref": "indicator--2323b50b-52ab-45e3-a9e2-c4ff42dcf656", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b620a15-97e8-423b-bc32-2524ed985bd6", "sighting_of_ref": "indicator--77c1bd76-09b9-4ba5-9874-42d5f5414610", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f0a6a77-a386-457f-b16b-f18c1d50ef8c", "sighting_of_ref": "indicator--4acfce48-ac38-42be-87ca-479291134483", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--debed114-5810-4c16-963c-8f57048ac2c7", "sighting_of_ref": "indicator--17d4fece-9c7e-436c-a9fe-edad48a98593", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca4c269f-5dfc-444a-85ee-45980ef2e8f2", "sighting_of_ref": "indicator--9322c474-73d4-4482-bdb9-42944cbe14d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d46a737b-b72c-4c91-b5c5-dedb180c0b9d", "sighting_of_ref": "indicator--69bc9986-4b23-4558-8c99-3da701e025f7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3752afa1-4f9d-4d10-8907-82ad392efd9c", "sighting_of_ref": "indicator--3a64cdfe-d244-4048-82c4-b2298ec10567", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--199932c3-ebbe-4def-beec-bdfb215e4fef", "sighting_of_ref": "indicator--5114f358-10ab-4051-a0d9-fdc1c62bb101", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4d65dfb-ddb5-43f0-825b-9e3b0b62bd98", "sighting_of_ref": "indicator--cba62975-5f95-4b68-9b79-7329c6157803", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--943055ea-e8e6-4d98-85b2-7f66e38289af", "sighting_of_ref": "indicator--5810ea8d-5e61-43c9-97cc-b5ad4bf18195", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67220718-82a5-41d9-96b0-934b4638be4c", "sighting_of_ref": "indicator--cc12f56b-4ee1-4430-bf83-4ab4b7a877d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71237571-1fe9-4304-a3dd-ce3a390f648a", "sighting_of_ref": "indicator--501a62cc-a4a9-44f3-80ec-817d03ab67a6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d029f1f-3105-4505-8b79-6c1dd8a447f4", "sighting_of_ref": "indicator--a0e08a74-625a-4e8d-9172-52aaaed42c3a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--482a41f0-68e5-4f70-998d-1bdd95a46c3f", "sighting_of_ref": "indicator--5d7cff93-d043-4fab-92a0-4fd1707a752e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87a09b2b-e20e-4d9e-a48b-f44c41a428a4", "sighting_of_ref": "indicator--2b6c1564-e115-4f1b-a2f0-0f0513bd8249", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca36815b-2992-4a5d-859b-37f247767ae2", "sighting_of_ref": "indicator--11d6c201-eaa6-42b3-8610-2ed7106df239", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b44ce5c-5a32-439b-8fdf-6066ab7156da", "sighting_of_ref": "indicator--bc270dd5-8e81-435a-b0c6-6c7c0467d047", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dc19a7e-017a-42d7-ba4c-945bd2ea2643", "sighting_of_ref": "indicator--aa15a626-bc5b-4ea2-9054-5166eb630537", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cc314aa-1303-42b3-8464-3bbfa2c8c987", "sighting_of_ref": "indicator--4f29f079-2705-4272-8df4-8600cc6871e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34eeecbd-ba5a-4685-9fd3-afa8cfd013a2", "sighting_of_ref": "indicator--61904a73-ffba-4a9a-b353-5825aec3c370", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab1cb6a7-6910-4621-82bb-d70224cae0f5", "sighting_of_ref": "indicator--f2590649-e76e-44eb-a323-145bdc8f36fc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee535ddf-ffc4-43a2-a750-7c39a15ed6c1", "sighting_of_ref": "indicator--8c933792-9ed5-46fc-a789-16d6b328959e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ad72f54-5c46-4911-a322-479adec4de79", "sighting_of_ref": "indicator--9746745d-30ac-4895-aac4-dd772ec1f2a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68ad9942-6037-4567-bcc3-12db745787d2", "sighting_of_ref": "indicator--0fd71aca-a56a-4d5d-a224-34ce31a210d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69b23eb7-340a-4c60-8e54-5a0455bd091e", "sighting_of_ref": "indicator--1e2f61c2-3462-4da3-a4d7-ee4e212a9a6a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d27ceecf-8ee1-4a65-9109-f24a699cd11c", "sighting_of_ref": "indicator--1f1a8bea-48d1-4dfe-bc23-0b4f25c78568", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1084a682-09b1-402b-a836-4f0fb90ca8e4", "sighting_of_ref": "indicator--e3c404d8-7b45-4650-84e1-4e404b4154f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf534dda-5835-4630-b8ce-e32535294b26", "sighting_of_ref": "indicator--f54b05cc-6e76-43ea-8bae-cf3cbca681b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3945c2c-6f3c-4c0b-8b5d-3c8ff7758966", "sighting_of_ref": "indicator--ac53dc44-5f89-4066-bb9c-36d94a5bbc83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e579dbd-7cab-4410-b69e-15733f6cf414", "sighting_of_ref": "indicator--b2d822bc-c813-4f95-b913-21a691768955", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9cb96d5-bfb2-4956-97b4-cdb7731bddbd", "sighting_of_ref": "indicator--8d0d6f34-8564-4a7f-8683-27d8b47b34e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7296ef70-f59a-431e-9b78-d9fd20a3b7c5", "sighting_of_ref": "indicator--bb8d0218-3f4d-4723-ad53-f10cbc90cf29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92a3adff-d16a-42ef-8562-af8585fe5103", "sighting_of_ref": "indicator--208fdf36-708a-4358-ac54-d31d5c6a2c48", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c09527f-b4da-4728-9999-0280e6f0a410", "sighting_of_ref": "indicator--c515d1ff-4e9f-49fd-ba29-f876c573e60e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9b2218a-0df9-4ec2-b6eb-6b9a6a2ede94", "sighting_of_ref": "indicator--c03cbd6a-cc83-4719-9760-eaf20a62360b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80db4e42-3a53-421a-8662-64f2b1d4d365", "sighting_of_ref": "indicator--14410431-68db-499a-a021-7c7d7f71b938", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76da8378-6b6d-4f60-b97d-5bbce2c6cf63", "sighting_of_ref": "indicator--2e9e20dd-3dfb-4e11-a985-8217a588a1bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22d2122d-ac1f-4eea-8f1c-99bf224a4ba3", "sighting_of_ref": "indicator--d7c41493-f0bc-4db2-a3ba-9cab7364f450", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--931bf7e3-3e9e-48a7-a7f4-cbc89361d07d", "sighting_of_ref": "indicator--22243e50-71fa-4c3e-a901-99af4cf23708", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0e8e797-806b-4f37-bf00-e227a58b964c", "sighting_of_ref": "indicator--6a1b1e27-d60a-4803-9810-8a50b0cd2a59", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a48bee6-a077-44eb-9d20-286becaaa07d", "sighting_of_ref": "indicator--299fc746-4158-4fe1-8372-79ddbd1969ad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f22b7fe-ee25-4f51-a7f4-a4ae184e29ed", "sighting_of_ref": "indicator--6bd7cdb7-2608-4549-8bbb-8404e32b64d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--597aff1b-de4f-4bf8-bb31-d45e382dd8e0", "sighting_of_ref": "indicator--97d63c20-f0c3-41bb-9426-a2d1af321e9b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9739f91e-a9f8-4e14-a27b-ec371b81345a", "sighting_of_ref": "indicator--8acfa72a-7841-4ea8-8e2d-1364204adc6d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35e31a62-e4cd-4077-b28f-47b7a85c4008", "sighting_of_ref": "indicator--464ccdb6-e996-47f9-addd-14515b438ef3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e162ec9c-342d-4a66-971b-eb924fc1421c", "sighting_of_ref": "indicator--b2ae67a1-a5f3-4b95-ae66-9df68c3eca40", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8bb1041-4e64-4332-982e-f5806c7ce4f8", "sighting_of_ref": "indicator--2d8d0620-6316-49b0-a046-4ed077523a00", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fd09c0b-0b76-4e2e-87b7-245bb4cae898", "sighting_of_ref": "indicator--c7096364-fb85-4488-b2b8-2d9bb1f98140", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5899946-3c72-4cb3-bd0f-1af948ed922b", "sighting_of_ref": "indicator--60e1c388-efae-4f6e-a43f-f89827dc427d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a734dd43-42b4-4420-817f-0854bbe78467", "sighting_of_ref": "indicator--b3389213-2e4a-4b1f-94b8-11fdac444748", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cbeb858-c7d8-49c6-97dd-f6e2c29fa706", "sighting_of_ref": "indicator--dce0579a-b07c-477e-a14f-b75e41b9e2f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b93364-f6c4-4d58-ae1f-70522690e116", "sighting_of_ref": "indicator--fbc84eef-8b45-48b7-9f80-702c91daed54", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--900ac0f9-3655-40e8-830e-e9e11b3b270a", "sighting_of_ref": "indicator--a6a42204-ba00-4990-8cdf-933481f2a0cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac8583e7-750d-4c65-af7d-3a1dab7489db", "sighting_of_ref": "indicator--2cbfd9d0-13bb-4945-ae1b-0eece81555a6", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70ea5873-205f-426e-8084-83ca9da92c10", "sighting_of_ref": "indicator--b6d8a4c6-c3dd-491f-a491-6cc3517ed128", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c5b2a3c-511c-400d-9aa9-b006f582e318", "sighting_of_ref": "indicator--30b84b8e-93dc-454c-9877-fc7fdcc7280b", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e630532b-5009-4768-a748-f32378b72ce0", "sighting_of_ref": "indicator--90fce7a7-9e52-4625-a6ad-ca757fd2f24f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43d2f353-679f-4752-9152-1b811aeb99ce", "sighting_of_ref": "indicator--a533ab4a-e206-4329-a570-035d526e1d0a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4986227-acad-43a4-bd98-2258cd6e6d96", "sighting_of_ref": "indicator--3e11fdc7-9d85-44fe-bd1c-df313224d8d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91119fc8-7116-4efc-9009-1614f64d0033", "sighting_of_ref": "indicator--d88d597a-11d6-4cbc-b97a-8b63274f625f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d688f5da-31ac-4f6b-a425-fba67e7efe4d", "sighting_of_ref": "indicator--0e0f7a57-44e1-4dd5-af77-5f7c77a96b7c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e067d143-9940-4f4a-ae9b-2c0b8981ade3", "sighting_of_ref": "indicator--f65a5df3-0a6e-47ea-9b49-24810b123ab5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--965948bb-7bb6-4cc3-a793-69fc69282259", "sighting_of_ref": "indicator--0f6ce7f9-9971-4270-b535-ca11304df4f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10050f53-36d8-4219-9e9e-b47887540a31", "sighting_of_ref": "indicator--fe3f2fec-9291-4825-a614-5c1cfe14b908", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8f1bb20-b0ea-46da-8828-916dde57b228", "sighting_of_ref": "indicator--1cd8cd39-e957-43b6-b53f-6cb10d532536", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bb2b583-76f4-477d-b6a1-88c912e06e79", "sighting_of_ref": "indicator--c47423be-468a-4157-938a-61f38b292852", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fce99f41-5fbe-4bbc-b3cd-f7f59b790ed3", "sighting_of_ref": "indicator--3bc3b490-a5ff-43a3-8927-f9ca7145cb3e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4968b5c9-d3ca-4396-bf83-7bfac460ca04", "sighting_of_ref": "indicator--f71e351a-b821-47a6-b9ec-0449f3dd34c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d3da8d6-312b-4315-8bc6-591897510e2f", "sighting_of_ref": "indicator--a60eb644-9c21-41ff-a635-25090a727dfb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--645f4aad-6701-4c86-804f-ba65716ebbb5", "sighting_of_ref": "indicator--876cdf32-9393-4995-ae0b-f73f6f9c13dd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9715f8cd-34e6-45b7-ace6-eb2e9a7bf5a9", "sighting_of_ref": "indicator--5be56e54-c6d3-4f4d-a60f-ae52cd84e6aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07ecb4c1-7fe9-49b3-8a80-f78f61c0f3d6", "sighting_of_ref": "indicator--88657df2-67fc-4360-a1b4-c67187ffb460", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c421e56-5155-414a-9e93-9e6bca98ed77", "sighting_of_ref": "indicator--94b41bc9-781a-45b6-ad2f-4fae392cb7a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f406093-6e8d-4e2c-a088-a5413362d2e3", "sighting_of_ref": "indicator--1a773004-93d7-41f4-b6ea-f43f9606a239", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--383d8173-b7f9-4c44-b6a4-1b936bda43d2", "sighting_of_ref": "indicator--c669be90-4ce3-420a-852b-ca31473633f7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfac7908-c9b7-4513-b5fd-63274ad7c3c7", "sighting_of_ref": "indicator--a7c0d0da-e39a-419e-8fa6-4643a950e543", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7cc69a5-cba7-4965-bde7-a23d3fe84154", "sighting_of_ref": "indicator--144f284d-2b4e-406b-ab2d-da034f3448ae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c508c5cf-7d8b-4a74-854f-95f7ef0254fd", "sighting_of_ref": "indicator--10d02179-5fba-4710-9334-fdb1cacb93df", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93c23b88-1abe-4033-8f17-e9f430f7e531", "sighting_of_ref": "indicator--b5951b56-bfa4-4119-be29-609ae8ee3e13", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--517a036e-3210-4689-8fef-f929fc447fae", "sighting_of_ref": "indicator--589a537d-de09-43a0-8c77-7f3dd8ce0bcf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97cfe7f9-3141-421a-ba5a-19c9ee488e47", "sighting_of_ref": "indicator--a436d36d-7182-49a8-8715-c6321409d400", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b67997d-2c6f-4445-b49c-ad58c25adc11", "sighting_of_ref": "indicator--66dba217-f2e4-412a-a892-f79f2eff8030", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d34140ca-aa5b-4e6c-b853-94ed04417a02", "sighting_of_ref": "indicator--2ff9637f-c3e7-4ed3-976e-746b03f6df1f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad70fc95-d1fe-4faf-a423-c1ab16de16f5", "sighting_of_ref": "indicator--87f9caad-c76a-4e90-8fc5-f10c5f23dbd8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf4aac59-da27-46bb-97f5-7e4030b0d687", "sighting_of_ref": "indicator--efd2e073-fd04-458d-bb08-ab0e2e4e9a42", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3373ef29-7865-4043-9c2c-2f9302a30558", "sighting_of_ref": "indicator--459dbe0d-c7a5-4b23-bdf0-a1dfde34593f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16fd1e5e-caeb-4068-8e2e-9b96f5b25444", "sighting_of_ref": "indicator--e8ec9e60-75cd-4de2-8adb-0993eb6f475d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0706310d-480b-4d09-841b-91754e109a6b", "sighting_of_ref": "indicator--c9e41331-3c13-4758-b1d4-847e260f584f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23357918-054f-4a1c-adec-84cd3b44ea76", "sighting_of_ref": "indicator--ed9eb410-6db2-444d-bd45-43d867ba99b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12f504ef-5dc4-45d8-9280-fad95c5a6733", "sighting_of_ref": "indicator--49bff32f-228a-4b04-81af-0319cf6a851e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e619e391-52d8-4b69-b44a-210c82b6391b", "sighting_of_ref": "indicator--6e07b908-b5a7-4e7f-8362-3cd4513df034", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80141be6-9ea1-4298-ba54-e746fc759c0e", "sighting_of_ref": "indicator--41afcbb4-bab5-456d-8ae0-d309b68b6d22", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6778a30-217f-414b-9339-3840fd9fb412", "sighting_of_ref": "indicator--e5381349-997e-4473-ac0c-5841821254ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a08abb9-d56e-4665-a964-5abe4b3e0ee9", "sighting_of_ref": "indicator--bd4089a6-2d3b-4cab-908d-cb58af714f5c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08a087f7-1bb4-4712-811c-9e46312d6620", "sighting_of_ref": "indicator--db6e0620-d49a-4728-90cd-a6e221d19627", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0e40fce-d04c-4d37-8e10-0dd7365db441", "sighting_of_ref": "indicator--06999265-6714-4f85-b2f4-d09177a2ca02", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc7132e5-fa44-47f1-8104-894b796aa52e", "sighting_of_ref": "indicator--0dd189a2-270b-4e67-b0b5-af958f8891cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--866677bd-49f4-4e6c-96e2-40ebbc4c0f45", "sighting_of_ref": "indicator--2fc83ecd-682d-4c58-8ef9-747bdd7b95fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc91a57f-8bdc-4d01-aabd-908be1178b99", "sighting_of_ref": "indicator--a54fd27a-6c84-4e1d-8da8-1277f835ef7b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61e93c33-58f5-404d-8ae9-0a89ae15371b", "sighting_of_ref": "indicator--f10114b6-920e-471a-8954-d4512878d42d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08b66484-c5aa-4df9-ba90-5eaa55f72ac8", "sighting_of_ref": "indicator--46237140-9293-4579-881f-476ed54a08ec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89d07cce-f5af-475d-89bf-8da4988cd5c6", "sighting_of_ref": "indicator--05920ed6-440a-4348-9d50-06c5e7e479d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46773ee1-270b-485b-8734-6c954cf8c6fd", "sighting_of_ref": "indicator--4a8602c6-c7bc-4c51-9d0c-392f8b6a66c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7955e03-4cfa-4230-8dcc-89e061a41628", "sighting_of_ref": "indicator--5b28a421-1ae3-44db-b2d6-ed62e6cf5918", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f3be4ee-7e22-4743-8d99-a3f0ae0f402e", "sighting_of_ref": "indicator--18b22110-2056-4ea7-94d2-82e263486b7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b25bd4ff-1709-4d76-8dd6-678969b65f96", "sighting_of_ref": "indicator--c2441f0f-c43f-41a1-8cd9-4b14cd27e43a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12a7bc9e-e178-4f8e-b5dc-d652b85da1fd", "sighting_of_ref": "indicator--c6f744b3-c059-4274-8852-ac606482ee5a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3a28ec6-1453-4ae8-b3e6-2567bd1fe240", "sighting_of_ref": "indicator--857b6eda-e4df-48b6-90bf-910b5f41af37", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9db86a40-6394-4b60-9092-998a587cb968", "sighting_of_ref": "indicator--4d71659d-bbca-4cdb-a818-b79847563b6c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa74f52-f897-4db3-a2e5-a76d01b603a3", "sighting_of_ref": "indicator--62e360c6-3414-4d48-b07e-806a7a292a49", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3a63818-ba51-4054-b2f5-b2387123f52a", "sighting_of_ref": "indicator--3cb38fa1-8737-4183-81f7-62e7764e1e9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b26ea88b-0e1a-489e-9a0f-a2849a570a10", "sighting_of_ref": "indicator--c8f1a017-ad1d-45f8-8fbb-f8e914cdf3a5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b325fbf-d628-4f9a-b826-5bd7a25c864e", "sighting_of_ref": "indicator--be337f6d-fc87-4915-a905-eadf0b9f72ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5306cb15-6e91-49b8-976b-6f77e75ba286", "sighting_of_ref": "indicator--709eeaa7-6202-4f45-923a-cc2ddbaf5526", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--947d355d-babe-4533-a99c-9b86044dd598", "sighting_of_ref": "indicator--1a4a594d-3c26-4881-bfe7-ed5074df2fc0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2e2d0d0-dd3f-41e5-9feb-f569155effe0", "sighting_of_ref": "indicator--ab7d3570-7bfd-400a-8929-f2b383e775a6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02e2fb41-6583-4b0b-8853-341095816bf9", "sighting_of_ref": "indicator--b716961b-1fd8-4cf8-a6cb-b658f4f9fa3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--130e009c-e2fa-47d9-8350-9089a0ebb92a", "sighting_of_ref": "indicator--cc8c36f3-5a06-47df-8151-682f41c39320", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--788d4988-bb4e-45a8-86ef-e8e538b5204e", "sighting_of_ref": "indicator--eb19dfd4-8623-42dc-a946-f84f24247b29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04595cb9-cf41-422f-ad92-37906e21b449", "sighting_of_ref": "indicator--f548ab48-abc9-499c-b88b-c37ea9ac2b4e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd82523-d71b-4323-a07f-033c1a5de332", "sighting_of_ref": "indicator--88b04d1e-7ec2-44eb-a3b4-67cb68cbeec2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eed0f72-4a29-4f5a-8465-363447ae1d77", "sighting_of_ref": "indicator--3dff7831-eb52-4f30-8531-a476a72a8635", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--129f6a10-2510-4768-b70b-2c3f62cdf828", "sighting_of_ref": "indicator--cdaa2304-a85a-4f09-8fa4-46bedff367f2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eebffa58-e21b-4ab7-8128-0ea2d1014366", "sighting_of_ref": "indicator--c7235020-593e-4ceb-aded-608708bbdc97", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb8ee3b8-04f7-4916-95d1-34075526ef2a", "sighting_of_ref": "indicator--2cadd235-4457-4101-bca1-627ff6740269", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c49daf94-49f3-4292-ba4f-c22ec967d727", "sighting_of_ref": "indicator--e554f393-47d6-4814-b59e-0d91ce9c0ffd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ee84b62-f394-47f6-8010-74dc55055b53", "sighting_of_ref": "indicator--b3680115-04ab-4367-a687-a70429f28a3c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d3c4f52-52c5-4aa3-9f2e-734f9dd7f9e6", "sighting_of_ref": "indicator--e994cd23-f08f-47e8-8d89-d74db289bfd1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9e17d67-e8b0-4c81-be8e-b9cd2acda737", "sighting_of_ref": "indicator--12071aa0-63e0-4ef4-b3db-af0cef00caa0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d249117-a737-41ab-9ade-754820f00bde", "sighting_of_ref": "indicator--7026ffbb-06c7-461d-9afd-a0d25297adf9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--557c2ed2-155d-4bd7-a270-36607c06fa1a", "sighting_of_ref": "indicator--7be6e8cf-6c34-4541-85be-1f0c71eb2866", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7c7a561-16d1-4be4-bd52-3386ad730e4b", "sighting_of_ref": "indicator--3128f4f1-6673-40e5-baca-62dbf3cd3a94", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8da93ff9-b3b8-488f-b45d-419b6ccf7aef", "sighting_of_ref": "indicator--888fc8a7-4ed7-4bbd-88b1-3f831580d1af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7395d8e-1fe4-42b5-9660-326d6d7dbc21", "sighting_of_ref": "indicator--d1f1f630-7e4b-435d-9945-ffd0b8ee7bd1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68809cab-560d-493b-93e8-05ff2681d1e5", "sighting_of_ref": "indicator--e154e8a7-6e1a-4c39-981c-7c6f80cc841d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c97f7d50-03ac-48bc-aed4-a98fad7ff558", "sighting_of_ref": "indicator--49e5a1be-76d9-4fc1-890f-131eff054bf2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a1b5272-e433-4224-b8fd-28290db4e62f", "sighting_of_ref": "indicator--5b7610be-0643-43aa-805a-b43a5e920f6a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53e018e0-d3f2-4be0-a826-0ed15ed633f0", "sighting_of_ref": "indicator--c768b119-9c41-4bd8-9f38-63c7f25becb5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80181afa-29fe-45bb-bc2a-1f164ebfda24", "sighting_of_ref": "indicator--8dc524a7-c878-4f25-a31e-ccdd2955851a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0ffbb94-a64c-4d1e-a441-9b043f18cb09", "sighting_of_ref": "indicator--9cb1b1fc-fa12-48ac-963f-019ddbfb2d87", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6790d3f-08ad-4365-a469-a5d24377cfa4", "sighting_of_ref": "indicator--c3ea3003-5d15-4792-9fca-248a739ded5d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bec27785-28b3-4bf4-8a6d-160170a58140", "sighting_of_ref": "indicator--2d4ce7b3-1c40-4ab6-820a-5ef2b2a0f2a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27b51b49-dbd7-4dd1-bf87-c6443521bab7", "sighting_of_ref": "indicator--cf1a6b7f-4ba7-4cf9-ac94-7fdf8f23ba83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--957e09a7-efc7-4d9a-ace1-a46a79315e84", "sighting_of_ref": "indicator--cc9f0162-61fe-4c50-9d9d-f35720516425", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3338f6a6-046c-42a0-8a48-4fb37a988265", "sighting_of_ref": "indicator--f8dba2e3-cd5d-4e70-a386-c8bdecb9758e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81948861-2aac-47e8-9d17-66d1a69c0b28", "sighting_of_ref": "indicator--419bf3d1-b9cb-46e5-9d27-3f265ad3e9b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--359dfb20-0a58-497c-9c95-015fb1372539", "sighting_of_ref": "indicator--f68afbcb-c437-47af-a357-97632584286e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--278cc49f-07a0-4e8b-b6b1-a87271870fae", "sighting_of_ref": "indicator--42b86658-bb61-45e1-ac76-984ad4258404", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e491421-b5eb-46ea-b3d1-8f471e61d93a", "sighting_of_ref": "indicator--bc3fc6d7-ea0e-434f-b81c-30e5bc991924", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05896d9b-4a8c-4e82-bc9c-4a10028b28c7", "sighting_of_ref": "indicator--9396f1c9-0340-48b7-92ec-047313095c76", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--306020dc-5d1f-44f3-b052-e16bbf16d782", "sighting_of_ref": "indicator--d0ba8293-df66-4e82-bba3-41174c50e436", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7139d307-30a7-4ee8-9ac2-955418e8c1cc", "sighting_of_ref": "indicator--b12569a4-4301-4f79-9447-cb4580f55194", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d73d55-fa88-48fb-be44-d125d8e4827c", "sighting_of_ref": "indicator--8afba18e-5c8f-4e3a-be27-72bf350b216e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96f85d00-b25a-4431-a5ca-635097abfb12", "sighting_of_ref": "indicator--b23eb11d-6301-4b89-b85e-bf6450bbc657", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d649988f-d739-499d-b42c-048fcf27b3d5", "sighting_of_ref": "indicator--b111553a-411c-4a67-a094-45a363f2f164", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb0bdfa1-a292-4d22-bc14-21be83bf9b4e", "sighting_of_ref": "indicator--d338646b-eb38-4816-be2a-074c0894f43e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e851193f-5059-4d75-a05b-e9bc400a20f5", "sighting_of_ref": "indicator--704cff00-7189-41fd-8041-1fb72405282e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11cc6705-49d0-4726-a821-dd1854a74ec7", "sighting_of_ref": "indicator--92934d23-a663-48a8-9aea-b351da85ff56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79eba4ac-8488-447b-b220-af3af5ed5400", "sighting_of_ref": "indicator--980e4b7c-57c5-4b91-a04e-5f69f5e739c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb7dc3fc-5cc1-41c5-8e93-fa5570409a41", "sighting_of_ref": "indicator--9f6fa5af-018c-49d4-b9a1-1b7bd32f4381", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a882987-387f-43ed-b2a2-7effa748d33c", "sighting_of_ref": "indicator--c61bb739-5528-4213-a774-779f1fc5c6da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0416fd70-6079-4ecc-b763-2e32d136ff5f", "sighting_of_ref": "indicator--58b96498-31ad-4b57-9bb0-24b384438e83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d46acbdf-c397-4f08-bc2d-605493370087", "sighting_of_ref": "indicator--19458349-02cc-40dd-8afc-1df03540bca9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25abf59f-b093-4b07-83b6-16ba3e8ddcde", "sighting_of_ref": "indicator--6ff68bf2-7ebc-415f-8816-aa943a3dfc08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d8af12e-8234-4600-bf20-3ba3777438c7", "sighting_of_ref": "indicator--69f5549c-7423-444c-95f7-bdbf83008a1d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11be25f6-67d2-426b-8056-8ad40939eb6f", "sighting_of_ref": "indicator--514adbb1-7fd2-4613-99ff-e6aca45639b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff6ba441-eb4d-4ba9-9806-54dcdcf97043", "sighting_of_ref": "indicator--e906feef-9f1a-4f1a-8dde-ba1d5543f936", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae508801-1bb1-4881-84c3-d89b54b3d470", "sighting_of_ref": "indicator--19be0332-f752-4479-b3cc-f3785f2017dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--308f0bf4-bc1b-4a62-8ddd-4d41f3353a2d", "sighting_of_ref": "indicator--56c0ca6e-2e59-4a59-82c3-63c9b80922b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d06a7a92-94f0-46ce-9b44-e9753c828e8c", "sighting_of_ref": "indicator--762b24fe-cf08-4bb1-b3d6-f1b289e38805", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4070b2a-b6c1-49b5-88eb-debb901f4f05", "sighting_of_ref": "indicator--6ab9180e-021e-4fa8-8aff-4e987c50c6bd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9b6665d-90e2-405d-ab98-ff30d854d3b2", "sighting_of_ref": "indicator--e750d0fc-46db-46c5-bfa6-e51ac0265918", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6df37401-7fa2-41ee-8126-6a29862d420c", "sighting_of_ref": "indicator--0d47124c-35a8-45b9-aae0-2ea8cabf0727", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaae4904-02d4-49d8-aee3-8484b07ac4d9", "sighting_of_ref": "indicator--4426043e-722b-45da-8019-191826023751", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aec20d5-a68a-4271-9285-b73162693ec5", "sighting_of_ref": "indicator--2c8bbb81-3b66-447b-bfa9-a7ffcfe90fd6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87409efb-855d-4a70-9044-7f83b67fed27", "sighting_of_ref": "indicator--62b72b89-25f1-4e5e-a1ff-9e6ad7add5fc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11c0bc73-88b6-4d9b-b8b0-1a54037f349c", "sighting_of_ref": "indicator--2f471234-3caa-4003-b153-ee5702432eae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--227ba884-beda-444f-9b10-ab6391e3f2d5", "sighting_of_ref": "indicator--6333acdc-a856-41a0-9630-3e9acd7dbb7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc1e36a9-96aa-4230-8c3f-52fac6c72369", "sighting_of_ref": "indicator--a02a70ff-c886-48aa-81a2-23015a2800a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f860e22-c193-4ff9-9584-e58556f3d995", "sighting_of_ref": "indicator--53370b60-9653-4d65-85ca-519bbf172d4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--439f6039-53be-4172-989d-863d9bcf359e", "sighting_of_ref": "indicator--9606091e-4069-42f9-9e59-30d20f4427b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0feafa3-cfe3-4236-b2c6-12363092573f", "sighting_of_ref": "indicator--4eb6dca6-3309-440e-9fd2-7aca21aefd64", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6d01d5f-1678-40ed-9f6b-7caaf01dff24", "sighting_of_ref": "indicator--74cc2d44-c303-40ee-a43f-9fef3505ecce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5a9dc71-8964-4ee7-a078-9ac784063ed9", "sighting_of_ref": "indicator--74cc2d44-c303-40ee-a43f-9fef3505ecce", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--218257eb-76e5-4201-95d4-b6d4e8ccb300", "sighting_of_ref": "indicator--e0e62364-4110-4cf0-af87-0ea41119142d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbb2307d-9dc8-41a5-b0d1-d654e2f7f343", "sighting_of_ref": "indicator--56276281-de62-436b-9f46-827c08b527d8", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f583f1c-a138-4ec6-9e63-7bfce04d637b", "sighting_of_ref": "indicator--0c86c0c4-7bce-4de2-b085-0f8350b7d996", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48f46342-250f-4ac6-b30f-cbad42ac6bee", "sighting_of_ref": "indicator--51142e0e-0c37-4caa-bdf5-601a8a202081", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73ab2b4d-7b29-44b5-9d18-c694acef7935", "sighting_of_ref": "indicator--bf952490-ea83-4656-899a-b493e10eed42", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20627e6b-9a74-4d7a-b9af-e1e906993cd3", "sighting_of_ref": "indicator--a16052bc-ae85-4e4a-8ace-b996ba4205cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0766632b-0ae3-451e-98ba-42f095a65d71", "sighting_of_ref": "indicator--59021fe5-a9eb-4432-a0d5-9f182285b0a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da2db004-99b6-494c-8a3b-2945e31880a1", "sighting_of_ref": "indicator--6672f4d3-2e8c-440e-b816-224171fbd8b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4df880da-2085-44a5-9596-53c9d24bc2aa", "sighting_of_ref": "indicator--a0eb9648-6e9b-4fc4-b332-c5d08f20fd17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6454189-45f5-4657-9523-b22139198300", "sighting_of_ref": "indicator--48d18841-cc23-43c5-a38a-13aadcedd906", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a10f9950-cba2-4f47-b60a-96e8f41440cb", "sighting_of_ref": "indicator--8331f490-6fdb-4ddf-9ddd-a01a4aff688f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ee3cfa9-de27-4866-9aaf-f56e480f5814", "sighting_of_ref": "indicator--e1fee7d2-33db-400a-84cb-58819d99ecb0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4714b59-266d-4dee-a950-0f6435a1c451", "sighting_of_ref": "indicator--a45391d9-5315-450d-a714-229dd1065105", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92843c6d-de30-4aaa-99e4-86acaa7decb5", "sighting_of_ref": "indicator--10685382-19bd-47b4-add2-fcc9fce2b290", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93d54efc-3bbe-4b40-be59-8c5621b5955e", "sighting_of_ref": "indicator--ec407664-6615-4ba0-ae03-dc7df7202caf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e59ea9a1-baa6-4b16-a3c7-17c58b127ecc", "sighting_of_ref": "indicator--7a9b8259-262f-46ca-90ae-1d338ce9db53", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64f7f2ff-639c-4a85-8373-787b1c2f0877", "sighting_of_ref": "indicator--4fe3b3a0-e2b4-4023-8e7e-a79e31b1dbae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e22fd49a-c52f-4f03-a821-37246927aa1f", "sighting_of_ref": "indicator--08fd8836-f5e6-4723-b47a-de423a2aace4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d750e816-860d-43a1-a1a6-c379dff3c1e5", "sighting_of_ref": "indicator--a78d8eed-67c2-4b2b-842f-0159887ef869", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64589735-b2c3-4416-96b8-48b139375276", "sighting_of_ref": "indicator--eb479e08-3c04-4408-90ed-e8ca47887691", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--132bebd4-26d1-42ab-b123-4ccf27521645", "sighting_of_ref": "indicator--9745f754-7159-4d44-8a5f-dfe67b1bdb43", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b0f48e2-d01e-4d30-b6a8-04c04289e413", "sighting_of_ref": "indicator--a0456e32-86b0-44f5-a331-6dbe21b45f70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9047a356-0c06-4111-b0ae-d54d7b740789", "sighting_of_ref": "indicator--8a208b45-6d58-4534-b139-94fa85bcfedd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bed611e-389c-4304-b814-b47608435cf6", "sighting_of_ref": "indicator--e2bf4b33-f096-46b7-aba2-91a420c79a61", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71ef3548-8898-4ed2-9cdf-2a66decc5bee", "sighting_of_ref": "indicator--68a404bf-671e-4aff-86bf-0f34d39f6280", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1af880aa-2fea-44f3-8ad5-f3c40be7c4dc", "sighting_of_ref": "indicator--f0aac203-65f3-48ff-b06e-db0d5fbb8aa6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4df8cb99-695e-466b-8f70-1947a131722c", "sighting_of_ref": "indicator--875ecd19-d178-4149-9ecc-4105b2070132", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76fcb6ae-504e-4df1-9096-24132556d334", "sighting_of_ref": "indicator--dde235d2-a078-445d-8f07-7b1b59a3ef0f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46c89d16-d76f-40c3-8b68-55324b24a266", "sighting_of_ref": "indicator--701b7932-e835-4177-b32f-d17425bc8727", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--876f992b-e6d6-493f-9f65-358eb98f93f1", "sighting_of_ref": "indicator--701b7932-e835-4177-b32f-d17425bc8727", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb697fac-75ea-4231-91e1-ab4288cc12b6", "sighting_of_ref": "indicator--442ea33b-bd99-4850-a028-42713dcf706a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6863af2-51ef-4ebd-8865-f1692e33ebe7", "sighting_of_ref": "indicator--b212894d-46aa-45f3-99bb-4962aaa6ac3d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49b6e3bd-ce69-4989-a3bc-5615e3db8654", "sighting_of_ref": "indicator--6935a007-651b-4230-aee7-8dc5a2ae6b13", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ad6581f-f4cb-4aa9-ae0f-379b8e382573", "sighting_of_ref": "indicator--49ea6d0c-a491-4faf-ba2c-683b855c4a46", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2bb2c51-80d4-4445-88c8-b8ee80568781", "sighting_of_ref": "indicator--7b60d28d-60a6-4a12-ba08-f3c52935a181", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43ad2d90-5678-42f4-87b4-9b2d0ed7378a", "sighting_of_ref": "indicator--a1044b18-7fbc-484d-823d-1e12b9f67057", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc913a4f-18c4-413e-bd3d-ae56355abb70", "sighting_of_ref": "indicator--2a359cf8-cd75-4016-8326-78d0cd6d201c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff75ca09-81ed-4d99-b284-c70ea70765e8", "sighting_of_ref": "indicator--b851bcee-5e28-4b39-a5b3-fa454fdeb803", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1081b423-04fc-47dc-bfe1-6631339f4179", "sighting_of_ref": "indicator--68d40d08-30f7-4808-a3a6-ac9efefed51e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf53c217-bfe8-4e91-ae31-ae98e651f019", "sighting_of_ref": "indicator--b468d775-a144-4546-9902-bfc86102995a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1e67e0c-30c6-40ee-9c37-4e698dfd3dbb", "sighting_of_ref": "indicator--6c5d6e5d-459f-4463-a4a8-34ea27825433", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec2e1425-6b42-4ef2-b16d-78c2e13e5eb3", "sighting_of_ref": "indicator--9b44b8af-6d0d-434d-8b7d-dd5b764033ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--854f59ff-ffb6-4da6-8b09-e1df8ede9754", "sighting_of_ref": "indicator--51856c7c-a139-408b-a710-051326e0139b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26113531-7ab7-43c4-acaa-4cbb9f8eb85c", "sighting_of_ref": "indicator--0f1ccd7f-63c7-4b55-80ff-693ee55c8a31", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--736f6a62-63d0-49c2-9c33-8f4ef1f610ae", "sighting_of_ref": "indicator--f997a718-5dd0-4459-8c7d-64f4863ca7f7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0527ede-59b4-4461-a08e-049820be7dde", "sighting_of_ref": "indicator--720a0deb-a7bd-421c-87e3-a6a591d6241c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4859e985-035b-4fdd-9742-9f804eb4982c", "sighting_of_ref": "indicator--ccbd57a6-74cb-43d5-962f-be1430afda08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfe8fbdb-f642-4760-80a7-22c413eb3fd2", "sighting_of_ref": "indicator--af961e50-ed7e-4c90-89c9-ddd2927adb79", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4261389-f6a3-4954-b283-c062121f45bd", "sighting_of_ref": "indicator--631008cb-c72f-478b-9b09-e220a77b41b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6b66e3c-d60f-43ab-9c34-adae883083ec", "sighting_of_ref": "indicator--83ead3b4-5f6f-439e-9703-99cc276ade4f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f6a6bd5-b6b4-4087-8efa-bd7de2489547", "sighting_of_ref": "indicator--a8bff395-d474-4cab-ba0a-4d069e181492", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5c56b32-b1ea-4737-8e91-b79df087ebd7", "sighting_of_ref": "indicator--d92ea274-f142-4be1-af33-7c0d6b9253c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dae4d29f-93c2-4455-ae0c-eabbe82f2321", "sighting_of_ref": "indicator--c61ea404-00ff-4a53-a8e5-f9a03afac0c1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23cf51b4-a55f-44b6-b0d1-297ef82df63e", "sighting_of_ref": "indicator--e5532f79-8099-437f-88f2-afe087ed6117", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acb4487d-5ea2-4bc9-baa8-730a02bacc8a", "sighting_of_ref": "indicator--b9ea070b-41e7-410b-b1b4-55330b715693", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2534d615-5b3e-4548-8fa4-995f6adca58c", "sighting_of_ref": "indicator--98d77527-f9a8-4193-8bca-60144e121ec3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--501207b9-00f9-4857-831b-489be0cf8914", "sighting_of_ref": "indicator--43cf8c9c-22d5-4d0a-ba20-2bbff3992f15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f7538ff-986e-4325-a1dd-124053f19687", "sighting_of_ref": "indicator--2b642dde-5d05-4ca0-9a84-4ed6f3d04b81", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c889a0b6-1f60-401e-bd47-7a9e7ee65acf", "sighting_of_ref": "indicator--bd515632-4589-4bd5-83a0-131f0c336691", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4da2d93a-3e62-4625-8bec-09fe3e5a3040", "sighting_of_ref": "indicator--502735c5-4b96-413c-993c-416faa4536d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc477c56-f70d-4707-9a06-bab6caeb7213", "sighting_of_ref": "indicator--56e46796-d32a-4c90-8ce9-e57fbccda8d6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf722fdf-0456-46bf-8ed9-282f34956f2c", "sighting_of_ref": "indicator--33850fe4-a352-45d8-89c0-b7dae8098fe7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3cd077b-0b91-4a41-b90e-616e70f738a8", "sighting_of_ref": "indicator--dd16f6af-cc4f-4c35-8ef6-9abe63e8e8bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2508af9-845c-4389-8715-518bec5865f6", "sighting_of_ref": "indicator--0e7fbfe0-4ef2-4aae-a15f-9ab32905edcc", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c7955a4-eb13-403b-9d4b-b9e76870ddc0", "sighting_of_ref": "indicator--7821608c-9e63-49dd-9bb1-1a39f05ec4e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80ffe9a8-0623-458b-8146-e245da0a147c", "sighting_of_ref": "indicator--8b9fb8ed-a0cd-491e-9315-86f7016ccf6c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d01bed28-aa5a-423b-be77-015476d9b1cb", "sighting_of_ref": "indicator--ba73a4f5-fb11-4cee-a034-d5d901e9b0dd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a0affc8-7299-418c-9585-391854d7c6af", "sighting_of_ref": "indicator--45703930-d38c-46d0-a8f4-c326a82bbe78", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9183d545-31a8-45ea-ad43-a28c43f52fb0", "sighting_of_ref": "indicator--7579e941-a500-4ccd-894f-9407321dd53d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88757a55-bf0c-466f-8dab-1defc1df95e8", "sighting_of_ref": "indicator--b211fd30-8607-4e3a-945d-8446c3717eca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4610bbe0-98be-42c9-b1ad-0b0999156bc7", "sighting_of_ref": "indicator--8768b408-11a5-4f23-93f3-cc7f3a335def", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c800e28d-6384-4fb7-9f95-32c4392943ad", "sighting_of_ref": "indicator--f83edf44-af48-4dc5-b45a-13a2dadc70c7", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db71ffa8-d50b-4dab-bc9c-a96ba33fe857", "sighting_of_ref": "indicator--57c06bf0-379c-4e59-b8c1-b74f06914f4f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bbd244a-4a53-4160-8a15-e6eee8fd8382", "sighting_of_ref": "indicator--09b60460-7977-4a2a-a177-a92bd1706a4a", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94a14729-d645-466e-bcc8-fb663137f026", "sighting_of_ref": "indicator--45ecdf37-bed9-434f-a6f4-2642585d8ae3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f9017d4-c5f4-4514-8bbd-6b275437b358", "sighting_of_ref": "indicator--22d9fb7b-5e1b-4a14-b374-dfceaf58980a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f70cc40-8d9f-4563-b0a3-dc3427b97b9c", "sighting_of_ref": "indicator--b36cbee3-7b79-4ed8-aa44-e709537b1e7a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--629abc87-a4fe-443c-b142-d5a3fca84447", "sighting_of_ref": "indicator--83bb2c1c-472e-4d29-b977-90a71c8e9f71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab69a09d-9818-42e3-942a-0ceaf1a45f38", "sighting_of_ref": "indicator--73ba3820-ae2e-44a8-a08c-1a2f5aebd500", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96b7c96d-4c92-48b9-bbc9-8fdd419cf537", "sighting_of_ref": "indicator--a8ea21f4-2ffb-4cb8-b201-aa558b53a60c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--993cd2ea-4eaf-4a4b-af56-3c0493aebc18", "sighting_of_ref": "indicator--01d5cac3-3eb7-411a-9030-f5bc55579521", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4abb6cf8-e5d5-4b17-a7cc-e4048af2e362", "sighting_of_ref": "indicator--8265c2b1-38cc-42f8-9b06-3dddc6c26d91", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ccbf499-ca51-4d25-b153-bcf2592b1010", "sighting_of_ref": "indicator--14a9751d-6a11-4a64-b19b-858757617983", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe6b397-f374-439f-8a95-8c0b5be01d70", "sighting_of_ref": "indicator--3a6841bd-f682-4426-a653-d11592f365dd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04d92dbe-98b2-40e0-9809-9d5654859274", "sighting_of_ref": "indicator--c5108bfb-3a76-4975-a528-06ddcd35222e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cbe387e-7cd1-45c1-9f16-081de4932e86", "sighting_of_ref": "indicator--e8b1a296-4cd6-4b10-b4d3-4beef6144efb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e928e6f-f801-48b5-a0be-b74044d5c5b8", "sighting_of_ref": "indicator--769696f8-4078-4d00-9479-502eab6d7ef2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb7ec6ac-cc5a-4ed7-bc55-8bff794dff58", "sighting_of_ref": "indicator--6df51788-ca82-44f9-b618-1d0b6318a7df", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bb06d0f-7f1f-44c6-907a-f18a2e228a7c", "sighting_of_ref": "indicator--10245210-028d-46d4-9cbc-afadbca46d4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e3a0d7-9c2e-4500-834d-f564c8728883", "sighting_of_ref": "indicator--78b4b823-9212-4e75-a6f0-6134bbd04b08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dfee183-090c-4f7c-90d8-fd1779d1bcca", "sighting_of_ref": "indicator--18717c5d-b3de-46fa-a5db-c5a0af3758ad", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0182b94c-f22c-4e71-a3a3-0106b4c972c9", "sighting_of_ref": "indicator--48f91375-6962-4e50-ad8b-4dc6e2a6ce26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97e16c88-fabf-4c59-9611-d881617d9b19", "sighting_of_ref": "indicator--45dbc58c-7da7-40aa-b90b-6d15fd1ae539", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43f57b7d-6629-480c-9a43-894657c66427", "sighting_of_ref": "indicator--56f666d0-8223-43ff-8cdf-aa6175b7ecd8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea0c1038-44f8-46f1-896e-f210f41199ff", "sighting_of_ref": "indicator--c2fad3a4-a6d8-4ab5-ae8c-e78ac716c285", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0631552a-852e-443e-8ad5-56dc1354a574", "sighting_of_ref": "indicator--d71d71af-ec52-4112-aa4b-53ba9acfba1e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1877def2-7ba3-4672-b4e4-02957f32638b", "sighting_of_ref": "indicator--6514b9a5-39d1-422e-aef0-735946b1f5af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e359f6a6-ab4e-49d2-b14b-b5cfbfe11d42", "sighting_of_ref": "indicator--2372def3-c1b5-45bc-80e0-845ea9135fd6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8a14628-691e-4d5b-8f2b-3e231abbaacb", "sighting_of_ref": "indicator--6960cade-ac55-485d-b799-0363fac1b7aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5721b4de-68f4-4bfa-8cfd-fb70c55f4a5e", "sighting_of_ref": "indicator--b71e286a-8e3e-4c07-8b43-883f90411f89", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6af6f236-cbba-418b-8787-e4c0cb7d6da7", "sighting_of_ref": "indicator--8a11d2ca-dc72-4bb3-b697-0a9348962292", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7892b0da-32bb-4d8d-b201-841c5fb184f3", "sighting_of_ref": "indicator--577e43f9-bc87-45de-b043-2bd3353fc2a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6598a5cd-b39c-498e-b7cd-232e9a28e78b", "sighting_of_ref": "indicator--66d7f60b-ea37-4e6a-adf5-fd3382ea1f17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bbd7be9-0cc1-4637-8d06-73326d85ad69", "sighting_of_ref": "indicator--15444d7f-f230-4ea3-bbcc-85ace51da75e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3a5f8bb-bc00-4f0f-859c-0cc24e59578f", "sighting_of_ref": "indicator--d99fc67e-51fb-461d-8566-aeff3392c279", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d41442e2-d255-41ae-9e05-f795e70cc1af", "sighting_of_ref": "indicator--a35ddfca-acac-499d-8142-c5e6e4f4ed63", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62aea6e8-e679-41b2-a32e-dfe74d3ce1c2", "sighting_of_ref": "indicator--a35ddfca-acac-499d-8142-c5e6e4f4ed63", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--025148e1-0225-4e72-a67c-9a8c2fbae83a", "sighting_of_ref": "indicator--5e81178d-bcaf-455c-b6b4-406b19bd6bd6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0937fab1-6178-44df-bee9-49927d4f297f", "sighting_of_ref": "indicator--e1588203-1772-4eb1-af80-8d3ef5b93d11", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1940f99a-28dd-4683-bdd1-ed8dc41d7b14", "sighting_of_ref": "indicator--021cf274-af49-422a-a11b-cc66bb499c50", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48415733-d09a-4374-8f1c-283cc46d559c", "sighting_of_ref": "indicator--eb6ee688-2407-4d08-b6e6-04f3f8605f7c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf7fbc8f-9300-4733-b79e-6e3cfe3e5e43", "sighting_of_ref": "indicator--8b0a81ec-a27c-405f-a7c8-42238eee2a5b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e5bdb77-a276-4c7c-be58-03204e297898", "sighting_of_ref": "indicator--57264d70-aa5d-4b96-9c99-d7e1760aa728", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07d08afd-e14f-4614-a325-c38a0de28f18", "sighting_of_ref": "indicator--67c8360a-fb27-49c2-b69b-95a49c858874", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75dbaf10-3174-4061-9937-a31c76db7f01", "sighting_of_ref": "indicator--6bd380e3-115b-4ee8-b158-24aa7e606ab2", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa1ef58c-8707-4eae-9c1e-b95e0af34258", "sighting_of_ref": "indicator--8d53b4a7-31de-46a7-8590-7e5b544a061c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b8d401d-ad0b-4e28-8e51-00f6356ab3fa", "sighting_of_ref": "indicator--b2be4a21-2da8-4f1c-97a1-9958c15cd3ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91f7a5db-a7b9-4467-ba30-92dd3813f12c", "sighting_of_ref": "indicator--692b3f45-0b37-44bd-98e9-52ffa34e9366", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b971c1f1-679a-44b6-8b9d-3c6782d2e816", "sighting_of_ref": "indicator--796962c8-3a3c-4021-9633-4419f337bf00", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c4b5fb1-65b5-493b-ad6c-a7afd0d95843", "sighting_of_ref": "indicator--1859dcdf-53a3-40c9-ac07-1ad17291fdb7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16fe49e8-293d-4e8c-a72e-41e00b684f8f", "sighting_of_ref": "indicator--81258167-6099-43a8-b6e1-29193ca8fcfa", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5409c832-d0cb-4f97-bc7c-950426d26921", "sighting_of_ref": "indicator--ddbee690-6d4a-4547-9f7a-f15e63758f72", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f630ed5b-7ec5-4af0-be92-c39a515d08d1", "sighting_of_ref": "indicator--951de6ca-da7c-421d-a8f0-c6d7199881a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9345dcd-0332-49cc-8345-ed4e02b02eb2", "sighting_of_ref": "indicator--8e837268-ddef-44de-ab2c-68930e622a09", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fc9db5b-0fde-4b4c-8644-8b933f0291a7", "sighting_of_ref": "indicator--95495307-d408-4fd3-9d4e-da4081eb852b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9edffe08-0e40-4bde-8bc4-f6780051efbc", "sighting_of_ref": "indicator--db6bdadd-bfe7-4927-8ca2-8dcc76cf10f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2837228-f711-4d6c-b62c-5b32fff9b21f", "sighting_of_ref": "indicator--b256f1b8-b461-4a4c-8e83-98bcc3af044e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--815fc03f-c233-4776-83e4-7ec443665b8d", "sighting_of_ref": "indicator--c8d2ec22-7c6b-4527-a196-a1b8b8439a85", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdee6956-8e09-4249-b5a3-bdeee61d9614", "sighting_of_ref": "indicator--839d37ad-325f-4ecb-98ee-68ab143d1b4a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--358c0a6f-7c34-4e72-9d4a-413291f47600", "sighting_of_ref": "indicator--b36e8fb7-e87c-416c-983a-b5d320abc165", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--447439df-e268-4e44-aafd-8fd5a792dd4d", "sighting_of_ref": "indicator--c74574d8-fe7f-4838-9c1f-297b48e6151b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fce8897c-b6c8-42d7-8db5-55a5d12fa8bd", "sighting_of_ref": "indicator--88bfaf8d-6a71-4c3f-8919-d73a7ba72448", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd3d5771-dcde-4a3f-a75e-962cf8f10b51", "sighting_of_ref": "indicator--46cd4e3c-3247-4a51-acde-3a45178f107d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fca6595-5a65-49dc-aca2-7a61deef2d2c", "sighting_of_ref": "indicator--b8dfd81f-0408-43aa-869d-9e488dd8d579", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--531e25d8-2422-4596-acdb-026c4d45ee2e", "sighting_of_ref": "indicator--a3068c45-1db8-4c4d-a17b-e95f20e9a062", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be15e293-b405-4834-a137-88c6309ac29b", "sighting_of_ref": "indicator--4e639dd8-1a03-4e46-af1b-ed98c4b6fafa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b5f65ea-9762-49c4-bff1-e4fd448a97dc", "sighting_of_ref": "indicator--227accd4-6c4c-4c24-9830-6740b48fb1be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--017bd404-3e40-41e7-bc88-4a463176c691", "sighting_of_ref": "indicator--ea31ac6e-20d3-416f-9025-f83e412d3ea8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa826a79-cad1-49da-b639-71471bb41b53", "sighting_of_ref": "indicator--0124d42f-f5ea-4dbf-a9c2-4cb0af0062b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0f06301-3f57-48a1-8411-06a43cebbc9b", "sighting_of_ref": "indicator--96e356cc-1af0-40d6-ba93-62007dfb0e25", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea21bd39-4bc5-4ad3-ba19-48deb276b794", "sighting_of_ref": "indicator--3dda1d3e-461d-48ba-843a-abec1afe80c0", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--068879a8-7b68-4524-b129-d933f67b7e55", "sighting_of_ref": "indicator--dc4eb2cc-89a4-4876-8740-10251017445e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a7e9344-e7b3-40d1-8018-4fe32c262025", "sighting_of_ref": "indicator--e514056d-230f-426d-819b-9b694a782d26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6602c17e-9dd0-4133-8fbf-60af7ea8681b", "sighting_of_ref": "indicator--3597f003-a7ca-4239-8f2b-adb4fb29c2a3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--917ef69c-746c-4820-b212-123f28fdb3a9", "sighting_of_ref": "indicator--047b6989-c566-4028-a0bd-4eaff85d93f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--964cdf7d-e808-4cd6-9fdd-b1dc4401ad61", "sighting_of_ref": "indicator--6af59633-1c04-4597-84f0-eca260bf07f0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--235f4854-52e2-4836-b55f-34af769f0733", "sighting_of_ref": "indicator--d93cc801-f058-4f8a-b581-3394638956cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9e88483-8c86-4d8a-8887-6bee2508ec17", "sighting_of_ref": "indicator--56cf9736-5066-4eab-9468-4a7ce349c24a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3208820-4e7e-4643-964d-a0cf5ac06054", "sighting_of_ref": "indicator--85baffcb-c79e-44c6-b4d1-0d8c4b8ead2c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--281a2342-86d0-483c-8a99-7d3748f4ff9c", "sighting_of_ref": "indicator--549b27dc-fbed-473c-9036-5abbc05781d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de85b304-5f24-4f71-b67d-84cefddb0584", "sighting_of_ref": "indicator--34bf9d82-911b-4a37-9d65-d0a6f6963499", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d07604dd-ab72-4171-b32b-06ef38cfd1c4", "sighting_of_ref": "indicator--8a33dd4d-179d-4102-b996-79ce82b45659", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63e77990-9faf-4468-b2a5-2310f2a6bb5d", "sighting_of_ref": "indicator--2b91665b-527f-4242-9001-22d4c06dccca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce5fad6d-1d5d-4ca5-b169-6758ef7a0c6b", "sighting_of_ref": "indicator--27700906-149c-4a9a-b96d-422306bceb1d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a0858e0-4b70-4e7b-afad-fc1bb52c6bb2", "sighting_of_ref": "indicator--d0d8d382-6b1a-474e-b89c-4c79fd95f298", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccf72fdc-787a-4952-9cab-c2f497319ea3", "sighting_of_ref": "indicator--b95fde70-39df-4be5-bb2a-a784b7ae4aea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd016dea-a85c-4b5d-9beb-2e8888319ff5", "sighting_of_ref": "indicator--94c9117a-154d-4d16-9268-fceced438ec0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4402f560-ea9e-4224-aa7f-1098ea7e19d2", "sighting_of_ref": "indicator--ed5c9f2c-1440-4d28-931c-aa1d1bf262b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--332a78b9-62c0-4b8b-a132-3389d803c769", "sighting_of_ref": "indicator--9aa1da02-a6f2-41ca-819c-e25801b56ad4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9795774-cbc3-4533-91cc-18a0f34f09af", "sighting_of_ref": "indicator--2da527d7-7ce3-4a19-b56e-836fb49d6794", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c73bedf-d045-4251-91e5-4bf1ec0610a3", "sighting_of_ref": "indicator--12aadbae-5ee4-49c1-b986-c505c2f3a11d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b274bae6-476c-40a9-ab30-57e110160289", "sighting_of_ref": "indicator--04478b2c-e5d9-4960-b7d8-9bf0cdf85693", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da0fd837-9080-42d2-a3e0-b2834b038d2d", "sighting_of_ref": "indicator--c9586ece-4dec-46a6-a339-a923caab2f36", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bee7b765-7abc-4dd6-9a18-e6e9256de3f9", "sighting_of_ref": "indicator--c8d04357-aa2b-49f8-93fb-206bc6f393f9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a631dfc-5fa1-4d9b-b915-1964f3b3a951", "sighting_of_ref": "indicator--b5b54eda-939d-472e-a1d8-2093ca7e58a9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0759a49-1d60-47ac-aabf-aa4caaea8e51", "sighting_of_ref": "indicator--7b0dfb98-7f97-4433-bd80-56394d082ffb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65bd447d-8d12-43bc-82c6-bc70bf1aea6c", "sighting_of_ref": "indicator--0c46ae94-c95a-4521-9834-abf9884f61f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90109dfe-7e3b-408e-b399-3089fbaed3a5", "sighting_of_ref": "indicator--ffd20aa3-d9ba-476b-aacd-4f91f305cbe7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee445f0a-8c29-4a0d-ad94-191cc4592955", "sighting_of_ref": "indicator--c585d973-c03d-4345-b468-b942248d2279", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e044b503-f37f-47b9-9c65-982f579445f0", "sighting_of_ref": "indicator--c3e9506c-7e85-4fa3-a12a-37e0b325b7bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fecaee07-1558-4b3c-ab16-a4bb00784fbd", "sighting_of_ref": "indicator--b32559df-d7c5-43a1-beff-b99d5fb03a30", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41f92f09-ab85-4da1-8caa-64af279a0667", "sighting_of_ref": "indicator--b4f8aa9d-8eb2-4146-bf45-34c1e669c8c8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25b1b8b3-0644-446f-8617-b2fed4939569", "sighting_of_ref": "indicator--19430d68-8069-4852-8d78-7a32a8926d22", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e60273f1-c300-4b97-9ab3-1dc4ad47cf5b", "sighting_of_ref": "indicator--f55bbcc4-6096-4a57-8711-80269e43c012", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--032fe8e2-ed4d-4100-8b9b-711793b2b850", "sighting_of_ref": "indicator--957532c5-f91f-46d0-81e9-d662a1e0b24c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e91262f2-694d-41a9-821b-bdd0d1d42d51", "sighting_of_ref": "indicator--21a48221-ffee-47b0-a67a-9cb2806e996e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3fde94f-e7b5-495b-9185-aad4d5cdd245", "sighting_of_ref": "indicator--d74ea871-fc49-4677-b9b4-7cceee259cf1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa22495c-90da-4244-b848-e23cbde11a70", "sighting_of_ref": "indicator--2a813fb2-7699-43c5-9d04-bd1c1a6a72cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19e63426-20d0-4a13-a02c-1945409199ec", "sighting_of_ref": "indicator--3a70f204-a7ca-46c3-85f6-1b2063432f43", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29c13c07-d682-485c-9956-42cd7d629564", "sighting_of_ref": "indicator--83f22f88-0967-43bc-9ad5-5f1eb1323e9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--492a332a-fecf-4fde-8138-514f0f842d5b", "sighting_of_ref": "indicator--3b3c3f6e-c652-4c7a-a5e2-d8eb88ccc611", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9abde2f-e81f-4e2c-a6e4-baf75385e0f9", "sighting_of_ref": "indicator--a0a8d304-0968-49bb-ae72-11d811f0d924", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e27589e8-0be8-4687-b889-a5e1090615ea", "sighting_of_ref": "indicator--f5c6015a-0b5f-4255-b45d-c4c88d45f23b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79d161d4-5795-47f3-9bba-515b0854a100", "sighting_of_ref": "indicator--78baf8f0-8582-458c-896a-62380589eac0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4bc5f77-51a3-456e-9edf-c20d04f2b218", "sighting_of_ref": "indicator--ab436fed-13ea-4f36-b33b-9d51aa3a116d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac2178ca-856c-41ac-879d-8d1a7c4b84d1", "sighting_of_ref": "indicator--045971cb-41e2-4677-a343-0c7e27c05e49", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8abfa2d1-0d22-4e4f-aa80-375e0371c904", "sighting_of_ref": "indicator--594b3dcb-3f58-4906-be9c-777f7d4cf70b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6000d5d5-8ce8-46d6-858e-399bba4101c0", "sighting_of_ref": "indicator--856d30ae-8994-40bc-bc77-4c6c659be563", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48db074f-078b-4e73-b2bb-c31c4bf2d25a", "sighting_of_ref": "indicator--384a87f6-7a71-498b-9bc8-e8ed7c1e10c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fadad091-23eb-4195-b7a9-f637429a5c49", "sighting_of_ref": "indicator--60e52195-29aa-41ae-b053-9a0cd4ebdf1c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a6d6d12-dbd5-48fb-a7ba-c5030d16a4a2", "sighting_of_ref": "indicator--3cd5b21f-5855-4def-9369-05318b0e54af", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a180cd55-32eb-4ec7-b35f-39575a05fd0c", "sighting_of_ref": "indicator--d544a34d-92dd-42fc-8db1-7f5c783e88df", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a30e87dc-6709-48ef-8c4d-9516ad2d020d", "sighting_of_ref": "indicator--33162aa0-9a58-4e5e-84f3-6ed4eb7d753b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06a2d964-df9d-4682-9df0-568f2736bdfa", "sighting_of_ref": "indicator--7e7fa52a-7c14-470e-b07e-3ace6aaa18c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--600a2fcb-6a45-4567-98cb-eb2da48d4edf", "sighting_of_ref": "indicator--bd0327fa-9504-4f67-ab04-1f4c2970822b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69c81ec7-3323-4b2d-9ecc-d9ab697c5f6d", "sighting_of_ref": "indicator--d85ffeb6-3861-491d-9f62-a32600a48933", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1be1ad8d-56a8-43a8-804f-2a08df6721de", "sighting_of_ref": "indicator--8f2efc0c-0d3d-4ca5-89c6-0cbba7a06711", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f8b7de-1f0b-427b-a3a5-5b1036734241", "sighting_of_ref": "indicator--533908b1-0668-4ae4-b90c-1b880fa8e781", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--197bf645-224f-448a-9a7d-9a0553b13ef8", "sighting_of_ref": "indicator--6fbfa2ec-72be-4793-90d6-7442e7b2cc67", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d786cf67-99ff-466b-8235-c278e1e69fc4", "sighting_of_ref": "indicator--f796bc1f-8591-434a-8887-f93a1f268cf7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb2645b0-77f5-4871-bb18-95ab4b9153a8", "sighting_of_ref": "indicator--467932ff-6060-4884-9f0e-48b43423f2d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--026b9814-5ed1-4656-8c1c-2f144d506749", "sighting_of_ref": "indicator--c0fcab46-040b-41c9-b806-fc5430e2d248", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e4703e1-4c16-40fc-a0ab-03ec56294615", "sighting_of_ref": "indicator--71c98bf7-58a7-448f-ace2-f1db9806e314", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb12c595-4656-457b-896a-47acccee76b2", "sighting_of_ref": "indicator--87da602c-a54a-4d33-94ba-5d95b770ee64", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15d50731-a296-473b-9b86-5e02ae509a6c", "sighting_of_ref": "indicator--6e17bf6d-7d90-46a3-9875-b60150888df1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--446d7a73-d79c-4f2f-a14c-8a134fb68ebb", "sighting_of_ref": "indicator--cc725a04-288c-4a56-8988-aff92610fc19", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d467119-abd2-4625-b8f5-b9c4edae395e", "sighting_of_ref": "indicator--ad5f0f42-6d06-406f-989d-9c24eac4975b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1f6e9c0-7d74-4bcc-adb6-9b5a669ef248", "sighting_of_ref": "indicator--760c7213-e239-4b0d-af98-4a889cd6a22e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--008a3adb-6cf7-455d-87c2-878a75a8ef73", "sighting_of_ref": "indicator--50990dfd-dabe-4166-8e91-3c71fcf84629", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e21f5550-d212-49d5-93f9-8a832e8f79ed", "sighting_of_ref": "indicator--4a56825e-7b44-4556-8bec-57c99b3e264a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa51176-5c34-43b2-80d0-9e970604199d", "sighting_of_ref": "indicator--0067466c-f176-4854-93a3-4708f16a0d34", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0dabd95-5245-4385-a1ca-5f66aa4cd150", "sighting_of_ref": "indicator--cbe2d677-8906-4d49-95a5-4cb622e91e8b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4686d4fc-c8f5-413e-b8cb-7b80b2f1364f", "sighting_of_ref": "indicator--ee9376e0-2b67-461c-884d-5c7ad97c0eb3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e8102cf-43ac-420c-8e85-1d3600d892d0", "sighting_of_ref": "indicator--ba7a843f-e78f-45ef-9536-f16ad41f91cd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c8f9d5c-aed0-451b-8b63-dd00dac14a9e", "sighting_of_ref": "indicator--34731e2d-f52a-4fbe-8d5e-7c8a63da4b41", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1a142a6-0cf4-45ae-8483-0734d03249ee", "sighting_of_ref": "indicator--b8bbca43-2851-4ab3-aa7f-98eba4f263e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--903eb4cf-bb64-4b22-9e56-d1efe07fa9f1", "sighting_of_ref": "indicator--5b599eca-b5c9-491e-ba07-0c7f81b9b9ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70f7a73f-e93b-4e03-8709-f5e77f1eacde", "sighting_of_ref": "indicator--ab746561-2030-4dc6-912d-f34fafdf0781", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2cb1253-b11b-4912-b798-6061d626bbaf", "sighting_of_ref": "indicator--dd499f26-6b39-4094-be5a-21d00e47bd3e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f86ed6cf-395b-47b0-a408-c8654f080681", "sighting_of_ref": "indicator--ef9d366c-2921-44bc-82e3-1930eb6059db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faaef756-98aa-4b4f-8e81-978cbd4474ff", "sighting_of_ref": "indicator--6231ce04-a623-4039-b7a1-9a458f757d40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f24f9d79-de33-41f9-ac34-1f59e8888e12", "sighting_of_ref": "indicator--dc2dd476-a160-4fab-a6aa-c194327178d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--434806f3-3398-4738-b35c-8dab84488168", "sighting_of_ref": "indicator--54120181-527f-4520-a21f-7dc6c06d9f8c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--670d9d11-ee8e-405e-8d6a-ea763f404e95", "sighting_of_ref": "indicator--d4fa623e-6497-45ff-a99a-bf5d0913f142", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f51e296-55b1-4605-b27b-4b33ac6e9422", "sighting_of_ref": "indicator--ff38693d-8dd6-44a8-b6fa-6dabfdbe9d98", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13a35242-6a08-4a2e-8c10-9ad5439b3db0", "sighting_of_ref": "indicator--f08b6956-d0f8-4bec-8523-2983a06ba75a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d860c07-268c-483b-accc-1caa5639c08b", "sighting_of_ref": "indicator--20dcb6d7-67f6-477a-bbc0-78da7726a2c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31880322-4576-4d32-abf8-8212c4ee969d", "sighting_of_ref": "indicator--71a24cc5-b20b-417e-9ea3-4ee5cf75c08b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--960ce5f1-e2e4-4729-be5d-ff9c22dc7cec", "sighting_of_ref": "indicator--efb6e659-f926-4a0c-ac8a-abf4e5599fa2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29ace9c8-ea2b-4dc0-b0a6-3ca6b5570dfb", "sighting_of_ref": "indicator--15395691-558d-4273-9783-ae170fd988d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2167ca4c-6b8e-40ef-9fb0-cd031aa55cdc", "sighting_of_ref": "indicator--cbf2899f-5b8b-4db8-a409-e5a97c233b9c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d2bb937-a813-4471-967a-9c6439cbbcfa", "sighting_of_ref": "indicator--72a74830-35b0-4d5a-8933-87d086cc176d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2869cb1e-d622-41bf-bac3-3295d05ab653", "sighting_of_ref": "indicator--9d1ac61d-f779-41b8-8b96-c568c3756aa9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba90546b-2a8c-4332-8914-78d86c3a42ff", "sighting_of_ref": "indicator--0de81710-b84a-4299-956b-6699a5eac790", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd6bcc14-001f-4247-a267-73d685cbeced", "sighting_of_ref": "indicator--cb57cff4-8d49-4c3c-b5a9-0be1a73a0b1f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--582b08fa-fc49-4306-af95-97705d5f728f", "sighting_of_ref": "indicator--5b9f0e7f-b4a7-45e3-8e18-5234ca78ebe6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--298a94f0-02cd-41f8-ae9f-c0040a2478d0", "sighting_of_ref": "indicator--674a67f1-7706-4531-b695-7a07efabe96b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7234d3b9-c69f-43df-a6ec-c998a2fe9fd4", "sighting_of_ref": "indicator--700478ed-0904-4ca3-9ee0-55eb4f7e234a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a541a36-9f57-405a-a1b0-c337a8203abd", "sighting_of_ref": "indicator--f0ef880b-714b-4ea3-bd1f-18583e17cb00", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ce1b203-50dd-4df0-91a8-8738ca64e1b2", "sighting_of_ref": "indicator--c9b7bb78-0403-488c-8bde-13d11f066a4e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf9c1b01-a7d9-4f71-a17a-6f1a3cd7c72f", "sighting_of_ref": "indicator--5e58c392-6c1b-4e81-980a-098b3219958a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f502c956-260d-4849-9582-d169fa1ee3a0", "sighting_of_ref": "indicator--6bfcf9d3-e469-413c-a91c-ad51755834e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d743b0f1-4eb8-4a9e-9d6c-f9811edfb41d", "sighting_of_ref": "indicator--0d63107c-b79d-4bdd-9b34-590f47cbd41d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35c7f2c-c3c5-4383-bc53-b2a76e2a6450", "sighting_of_ref": "indicator--fd482b0e-b574-443d-a21a-4b69be3bdfc9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b49f93c-77f4-4e20-83c7-a62cdeac1b3b", "sighting_of_ref": "indicator--1b250715-0886-4915-9ccf-e310dbdd98f8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3c3f438-000f-4fd2-9f84-4e2d961e7fcc", "sighting_of_ref": "indicator--3248617a-948c-42aa-8e4f-0c567c94dfec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fa970b1-b877-4f62-8f7c-f03dedf34019", "sighting_of_ref": "indicator--884ec1de-8dd9-4d06-a8e2-26dbfcbeac4f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--801d2026-553d-4a11-aa6b-caecdf149b72", "sighting_of_ref": "indicator--39bb679d-2126-40cc-b75c-384d8fb8b2ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--226427c6-57f4-4e0f-8c65-0289b01735c5", "sighting_of_ref": "indicator--03a5bcb0-a123-4f41-a0c8-84337f9c8124", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a52a766-6de9-4dd5-ad3c-656aaa79d131", "sighting_of_ref": "indicator--85cab796-3edb-4176-9ad6-255cdf86d258", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f00e21f6-b48d-4f24-b53d-4ad8b764f9a5", "sighting_of_ref": "indicator--214a8f79-c8a6-4127-933f-7f7be24d4ed0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6c55f01-6e86-4458-9517-ec944aa2f6e0", "sighting_of_ref": "indicator--393c21e6-fb87-4990-9460-b3d549fd6c59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0eaa903-3ad9-4118-8a7a-30b7049c99c4", "sighting_of_ref": "indicator--5f208f71-1c9e-4641-8081-6e77612eb211", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96d63e9d-af2f-464a-8484-3806cbd8b633", "sighting_of_ref": "indicator--3ba3822c-993a-4ffa-8048-b94dd04481bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--996f880b-6479-4406-9e68-4ba099f404a0", "sighting_of_ref": "indicator--4723e1ac-1162-406f-a399-f4137d1eeb51", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf9a4ce2-d2b0-4aeb-8161-50ad65a8d2f5", "sighting_of_ref": "indicator--52bf148c-0e77-48fa-9186-0eb96e468582", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--553d9ada-467e-4461-91fc-e6e49c7fa8d9", "sighting_of_ref": "indicator--0b4bb747-bbdb-4ead-a287-b4c56ac003cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80c6ca97-c6be-4223-8608-3c3cfd36e8b0", "sighting_of_ref": "indicator--0b4bb747-bbdb-4ead-a287-b4c56ac003cc", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bfdf165-71c0-4426-b39b-eba71394cc52", "sighting_of_ref": "indicator--4137afae-73d5-4f79-a543-5c2987d2883d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa0c61b7-4253-4a26-ae5d-203343435575", "sighting_of_ref": "indicator--8fd8cf70-07c2-4d7a-b69f-1082f09a6327", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--109ca943-b783-4936-a25b-fa4762a24141", "sighting_of_ref": "indicator--91aba508-b511-4526-b91f-3b80e0ce7da4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06263239-5a28-4aa2-8443-f59ffe0484d4", "sighting_of_ref": "indicator--cb7b2ab4-34f3-47f4-955f-0b0ca2ffd3c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3367baec-f806-4d02-bc6c-b2f92dbfb7d9", "sighting_of_ref": "indicator--b5845897-60b3-4b9d-b8c3-ee1311edbd9b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64f5f28e-84be-457f-9b98-4d8e558cc7d2", "sighting_of_ref": "indicator--ca52b564-b361-4c17-8ad0-d6e1a56eb18b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2e1582b-0f19-4780-8176-5b2ef448952c", "sighting_of_ref": "indicator--2d87a367-1970-47b1-9741-67ac31d7e829", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ca81013-7fba-4e79-995f-a0f5fcff0d44", "sighting_of_ref": "indicator--a3a1964a-1824-4140-9e33-c9877c1eaa71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36b1b951-259a-49f3-b7da-48fd7ff5fd1c", "sighting_of_ref": "indicator--e009b558-bac9-42bd-b831-5df91e2c0d68", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab6235e0-3ea5-4db9-be48-556f1667db20", "sighting_of_ref": "indicator--6ebfa2bc-3b53-46f4-997c-f4837e978c94", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--051d4085-fdd0-4ed2-9776-788c4a2da8eb", "sighting_of_ref": "indicator--917f7d8f-12bb-4264-af6a-3304b7c5c165", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be31fd07-4e2e-433b-8d9a-c78ce41e0f61", "sighting_of_ref": "indicator--2a78f7e9-de21-41fa-a0f3-511fd96b7398", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b7b99de-0ea7-41fa-9674-737e6a6c0504", "sighting_of_ref": "indicator--bc7e3411-abc8-43b5-b395-7d5bb3d3925e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70c7b63a-38e9-4e91-9509-5cc024cf733a", "sighting_of_ref": "indicator--b03018f3-ee7d-40c0-8fb7-7b47c9451638", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f59c15d9-88e6-4cdc-8e00-ed12cda8fde8", "sighting_of_ref": "indicator--f751ae04-f32e-4477-ae65-0c5e567d4625", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5062bb7b-ed8a-4aca-8f9b-2f903d8c4ec3", "sighting_of_ref": "indicator--4a4f6fe8-dd0f-47a8-bf74-afc32a45584b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc76f908-ac82-4d13-ab45-ddb9511a6309", "sighting_of_ref": "indicator--39830746-23a1-47cf-b799-166e88fa3dac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d6cb732-deaf-4a42-8e29-ae1b1e8de279", "sighting_of_ref": "indicator--d6cd52e4-9faa-425c-8bbc-6bf7a9863950", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c93f416d-4180-43bc-9697-027f523979f4", "sighting_of_ref": "indicator--ca0e572e-d238-4b60-8f1e-e4ef24f7a0ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7540c278-30b3-43dc-98b2-0bdb4029af36", "sighting_of_ref": "indicator--93a83832-7378-453a-a2b5-6cad80f8903d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a8d0622-b8ee-405d-bdf0-a12cdb1c0434", "sighting_of_ref": "indicator--f144b39d-fe43-405e-a970-38cf8caa95fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--463ac36c-3555-4181-acdc-33b99ef40757", "sighting_of_ref": "indicator--f144b39d-fe43-405e-a970-38cf8caa95fa", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5908c9ea-5835-430d-8342-b58ca1631ec5", "sighting_of_ref": "indicator--fd0abc86-9d16-4b99-8626-4c898ecaca6a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af72e8f9-9400-43d6-bb47-2095cd8c8b07", "sighting_of_ref": "indicator--99972e50-1b7a-49ec-8f3e-1ddddab8cb89", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c33f0ad-5858-4461-8bae-ef03165f8e26", "sighting_of_ref": "indicator--0c90d637-7586-4bf9-8b1a-7cfab054238e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55a9e734-5fb4-4efa-8caa-22f4509752fb", "sighting_of_ref": "indicator--3f266694-b8f7-4835-b33a-9ea0c0745698", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90869e86-ab6a-4303-86f4-2ce0205ada99", "sighting_of_ref": "indicator--4393f5f4-caa8-42f3-bb3d-a595a39ecc9f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1e983f7-f765-4051-97ff-ad927322cdfc", "sighting_of_ref": "indicator--2291187f-4ef6-4950-a0a5-b9b3122cc1d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60f14b9b-1fa7-4a91-ac47-db2c11f61aa1", "sighting_of_ref": "indicator--475f3b6d-d497-4a86-b77d-9a40f1445aa4", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0969a2a-9298-402a-a7e9-93217fb176c4", "sighting_of_ref": "indicator--49078667-fc6b-4c4a-887d-7d90752ef7e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddcab812-28a2-4c91-b338-2158b0f5a687", "sighting_of_ref": "indicator--fd3e2970-e076-4eed-a2e4-94ff497ba704", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c78c2164-8aec-47a1-a9bc-d32bdbf35fd2", "sighting_of_ref": "indicator--05c36580-94a3-41b0-81f4-c08817a8da8d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da221710-fc03-4614-a079-b3c3a30c96d9", "sighting_of_ref": "indicator--1152bc88-a3e1-48b1-ad5c-65d57824b8d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd30351f-bce4-4709-bb49-efb94f92772f", "sighting_of_ref": "indicator--5d12ff72-0506-47fb-b402-2f8438076d2f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b551ed1-6c9e-48ca-90c7-03080baec209", "sighting_of_ref": "indicator--991d450d-b9d7-46d2-aa67-d793c8e8274f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--852494af-05ad-4c2d-b55c-455802b22d89", "sighting_of_ref": "indicator--74b5c59e-e229-49b1-90a5-a7ced3f4521a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff19298e-28d3-4569-8b9c-1e38cfc0fb1d", "sighting_of_ref": "indicator--14580c1e-f65b-45ad-bd9b-b15a837a6f97", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dff35f24-2d3c-4d35-a372-3bbd364420b8", "sighting_of_ref": "indicator--08713232-d90f-48b1-832f-bd6e6272c007", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94e47dbc-f444-458a-873c-a6e3e02ca0e6", "sighting_of_ref": "indicator--1310ac7d-f0e0-4f3a-991c-9c6af83b3bd5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b41fd85-a212-44e6-92c5-5d33cde11e94", "sighting_of_ref": "indicator--252c55a7-3ee0-49d8-8a71-435ee448dd3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83a3c3b6-f943-4879-874a-79c93400b52b", "sighting_of_ref": "indicator--cfb844b0-b04f-4681-9016-91d6540c78af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d7bb0e8-cb37-402e-893d-c2c264f51890", "sighting_of_ref": "indicator--9de0e4a4-b248-47dc-bfd1-12e26332f581", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaef8dea-188d-4012-83d5-b75d80300690", "sighting_of_ref": "indicator--43cf773c-ae0b-4123-b257-6f6042ec57be", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71aa97aa-42c8-4251-ab70-99f39db454ed", "sighting_of_ref": "indicator--ec26d7e4-a236-492f-9fb3-c8408819e3d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40796960-e0c9-4bde-ac67-920490f9d075", "sighting_of_ref": "indicator--86085d22-c2de-4456-9fde-38519445afab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3cc8e42-49e5-40b1-bbc2-7049c2d0bda1", "sighting_of_ref": "indicator--d532e4bc-82d0-44d7-a783-9e3695b61498", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b69a504b-be13-4889-9fbe-9622c2c00873", "sighting_of_ref": "indicator--4cb55bf0-7939-4dd0-ac5c-8974465f2e4f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b568111-9bdb-40ee-865f-3848fa5ac0d1", "sighting_of_ref": "indicator--58639c52-cde5-40b0-b1e0-1875bc6028eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfcc99c6-9bbc-42ae-9a9b-834048ea2a96", "sighting_of_ref": "indicator--f0e456e7-0950-4f5b-bffb-c9033bfba4ad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73cb01b3-97d5-4d53-88c2-6b4437f8ca6f", "sighting_of_ref": "indicator--d854bc78-5727-4a39-9826-48fdeee4f20d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c5f5a87-1b57-4032-b4a6-557c58555306", "sighting_of_ref": "indicator--3a61e0c3-8dc0-42ae-929f-fa59ee50905c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6467b7f-27c5-497c-8ab3-7365623750cf", "sighting_of_ref": "indicator--188a8333-2a8b-41ac-a150-8909f20460c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8f35e93-6a14-4e35-8aed-d474b05e21f6", "sighting_of_ref": "indicator--6ef52edc-cdbc-4f16-8b14-d787066c0a4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81dbe469-0fbb-4e74-80b6-a2f02ac5167a", "sighting_of_ref": "indicator--17db7ccc-d087-406a-8221-3e51c1123e53", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e5b5707-fcad-4337-9f41-52a6fa43a599", "sighting_of_ref": "indicator--b8bafd12-ffb1-436e-8a04-b05d4587f30f", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3bcba13-79a4-42ca-87b5-258fcc65d407", "sighting_of_ref": "indicator--3778afe9-5dd1-4c31-8ca8-654fc3efa2e3", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07475555-764b-436f-a7fc-9c3a549ab959", "sighting_of_ref": "indicator--a437939d-04e5-4022-a16b-fcdde2b7b73e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b49d4296-1cf9-4757-82d6-ee076d05da15", "sighting_of_ref": "indicator--a08b0444-f5d4-4df5-8268-38be2cf77ea3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1a4ae13-b143-4fe0-8343-357b60d810f8", "sighting_of_ref": "indicator--32261d18-43d7-403e-a098-c1e20c091f26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4148b27b-a287-4442-a28c-ab8651e192d8", "sighting_of_ref": "indicator--fc63c26a-7f83-46c9-bcb4-ce292cba9c14", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9845c9cd-06a8-478f-a4ed-6464a61a62c8", "sighting_of_ref": "indicator--e93fa1c8-9291-4ec4-91fd-e8e2dcdc40fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55dfa3d5-7c65-4f39-93bf-b131b06d0ff3", "sighting_of_ref": "indicator--c4ff0921-ced0-40f8-aeca-c446f6fd3686", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--951fdbff-1f15-441e-972b-b55778ceacc8", "sighting_of_ref": "indicator--e2ee8795-7989-4802-8e28-26568b05cf05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a04799d2-3a7d-4a88-8747-5e235c26740d", "sighting_of_ref": "indicator--e96ed704-5ae7-4f76-952e-9f812759d916", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b09e2f8-1a39-4846-9773-2520c32e4df2", "sighting_of_ref": "indicator--2e3f16ca-dab3-415f-94fb-bafcb861e135", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1773de3-ffed-4c8b-8a5d-e46b70d0f40a", "sighting_of_ref": "indicator--501f43fa-f3af-46d7-8fb2-960a5de4b406", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f388f61d-0a31-4324-a02e-4796c998c8ba", "sighting_of_ref": "indicator--15bf7ff8-4a92-49c9-8920-6594d1b79f45", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66005e63-f416-4d7f-9bc5-c73236050fc6", "sighting_of_ref": "indicator--e91ecc89-3937-48eb-b3d0-34e64baf34f6", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2258d82b-6928-4aee-8837-cf069eb5bdb9", "sighting_of_ref": "indicator--797c17e6-972f-41d0-ade7-bb257f54d4a7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--436bef22-338d-4722-8b6d-ab6dbed1abfb", "sighting_of_ref": "indicator--495c5ab2-67b6-44da-890f-2e95308f563f", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20446411-6726-4ff5-a933-45c7ff894f17", "sighting_of_ref": "indicator--cfebb20d-0871-4aa3-99b3-76d1fc39c2df", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9d28cb6-3001-472f-a941-ff2341265131", "sighting_of_ref": "indicator--5adbca6c-5b1a-4388-9898-95b4dc2cdf94", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88dc80c8-096d-4e56-b28b-e5bb5890cb97", "sighting_of_ref": "indicator--5eda7ccc-88c7-486e-8102-004e6e9c68a4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51b19e1e-e700-485b-b46e-c717fcdede9d", "sighting_of_ref": "indicator--59781518-dabc-4982-b39e-aedad27590cb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19c35ba9-9dfa-4026-8d90-492aea323849", "sighting_of_ref": "indicator--0a64b6da-84b1-4c61-b218-56ca029eb595", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc9e7c4b-4aac-43aa-bc63-473060a3fa77", "sighting_of_ref": "indicator--4772b219-005d-4ce3-9b46-7e92fa751aaf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13565aeb-c334-4f1a-8408-790ac6ba30a6", "sighting_of_ref": "indicator--287b4429-79dc-4b76-83ec-28ad8491535c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fed53b9e-7e70-4433-bfe9-c67920afa4dd", "sighting_of_ref": "indicator--099bdd36-cc57-4d90-ac9b-de2b108ab996", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74092b55-6f88-484f-81de-4591b952688f", "sighting_of_ref": "indicator--516ff83b-179b-4397-af34-54beda3d5d77", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a05a80f4-cf4a-41ba-b3d9-fd7c0577efa9", "sighting_of_ref": "indicator--9610b3cf-64cf-4f11-b42c-3b3f7a7ea638", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b51cd25-1716-4445-a024-a934a86314b9", "sighting_of_ref": "indicator--46cb7839-9a61-48a9-80c1-a88596f5fc3b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ba8e0a9-8163-477c-bbfd-67faf677283f", "sighting_of_ref": "indicator--bf5f9331-0df7-48b7-88ac-947fa1fb810c", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--581bd631-aa70-4598-a313-ed5b92c08a95", "sighting_of_ref": "indicator--bf5f9331-0df7-48b7-88ac-947fa1fb810c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--845d4e39-ebe3-41e3-afd6-71c0d8aea600", "sighting_of_ref": "indicator--2880da3e-1c7e-4f6c-ab52-1e4109c53d08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8492e6ab-493c-47ec-a8f6-cd315e61a08d", "sighting_of_ref": "indicator--f53c0792-561a-4124-93dc-ca9aac7f9003", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f602b26c-c196-4e2f-af02-b0c6027c1392", "sighting_of_ref": "indicator--61d40d7f-216a-40b7-92a9-f75702d58fe8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e207f027-43f8-455e-aa3a-9ab33672248c", "sighting_of_ref": "indicator--7c33f48a-30aa-4b35-a532-1672e60c7d19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4790e4a-5093-465a-9675-daa08a828bee", "sighting_of_ref": "indicator--1ff46b1c-c07e-4146-9457-7bbd23ee50c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bed31815-298a-4f5d-bf03-8bbfc92344f2", "sighting_of_ref": "indicator--7235ec2f-f22b-4843-aa8a-2b31ee5499e8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--297934c8-26f5-48a9-ba8f-0c05eb81e49a", "sighting_of_ref": "indicator--481dcd8a-d909-49f2-aa90-ea5ea9c791ad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e829655b-89b1-4a1f-abc9-c026d537f750", "sighting_of_ref": "indicator--926241f2-25f1-4a65-af20-08168e52984a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce8c46a2-5b05-492e-8aaa-fcfada71a9f2", "sighting_of_ref": "indicator--af0b2f8a-fc25-4ff3-9e3c-2e25591e20ce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b40911a7-f618-4e96-8175-c81f4c88e4c3", "sighting_of_ref": "indicator--60bbdfcb-0a45-4908-ad94-253163f7cba0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7f1ca99-8938-45ed-827a-a4a4a008d4b6", "sighting_of_ref": "indicator--c9881c25-ef89-431a-b2f7-cf9c4402a4cf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b19bc6e-7261-4e6f-b4a4-d34e929d7d5a", "sighting_of_ref": "indicator--aee72775-9960-4471-8b7d-f214e353eefb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43f1d381-8657-4fe8-b7e9-f88a8f1cad51", "sighting_of_ref": "indicator--ae8f4d0a-672e-438c-8ddd-faa6bf5df143", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fcadf9e-b27b-42f4-b3c5-9dbfadcecae2", "sighting_of_ref": "indicator--2d4bc947-488a-46b4-ab27-dd60fa16b26f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--691dd83f-53c6-4e46-b8ef-6470e5d9c1ff", "sighting_of_ref": "indicator--a5e3aa3d-5c96-457e-8bf1-3146c0df1315", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d195e4f7-1c84-4b0d-89aa-632660f6eba5", "sighting_of_ref": "indicator--bf6554b5-ec07-4ac8-88dc-a8335bd8d0a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f81bb6cb-e5c8-4eab-a932-e4a141c5180a", "sighting_of_ref": "indicator--29e90b2a-05ff-4aeb-8adb-a762b9560f36", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16021333-fdf8-4ff0-b288-17f860c2385f", "sighting_of_ref": "indicator--04b97c59-f709-4854-82eb-4fcb4e48243e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bf76cc9-d933-421f-b2f9-3bb96368844b", "sighting_of_ref": "indicator--c0b1293e-1e48-44ba-ba93-ab9bfd472a33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d670441c-1249-4b47-9c88-daac73dd46e3", "sighting_of_ref": "indicator--77fd03d2-b5ee-4be7-b4ba-a0ecf45b5f15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d95777b-65a2-40c8-a46b-336ef9ced6f4", "sighting_of_ref": "indicator--08798de4-274b-4065-b25c-9ae662bbc2ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5c40bbd-73cc-4685-bc86-98b0d592542c", "sighting_of_ref": "indicator--cb6aa1d6-2672-4c2a-b32b-4a68185fe0c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c69cc90-68c1-49d1-ae57-df5f23d2ec9d", "sighting_of_ref": "indicator--332ea12e-4480-4582-9cb2-150e5b36471f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cf1981a-5468-4098-b819-bcc94ea4fc11", "sighting_of_ref": "indicator--94f215c1-ac46-48f0-a2c8-a3ee4461342e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d54c8a6-b706-477d-ae92-d1d57b54eea1", "sighting_of_ref": "indicator--f6b6ac16-df84-4835-9dbf-4767c460c825", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1f62030-1761-47b8-93d4-0177b6101a46", "sighting_of_ref": "indicator--ec5f2037-d807-4e06-a493-b4ba25323f8d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e5c851f-6077-4e06-a33d-f90b9444bb8c", "sighting_of_ref": "indicator--3f48f473-5d65-4280-94db-8d2003323abe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4171af9a-301f-4138-a99d-8d94f49d0fe3", "sighting_of_ref": "indicator--997ca7a2-8667-4659-a7b5-d1d9dc3b37ad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--049113e6-1f10-4e14-9dc5-4b7fef5b30ac", "sighting_of_ref": "indicator--4fabd90e-28e2-42df-b093-4067c96c8ea7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64185ff7-5e46-4fd8-b77f-e5a3c5a5a38a", "sighting_of_ref": "indicator--4270b522-43b5-4af9-b539-4a7ed57c0418", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--793bf096-63a3-4138-911a-d8440f7f028b", "sighting_of_ref": "indicator--2ed59df9-19b8-47c3-979e-a5600928a495", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2455c99f-be30-42f9-8c9f-fbeb291ccde6", "sighting_of_ref": "indicator--773225b1-04aa-49cc-91b5-4441f93e4a03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--067203a8-79ed-4374-8cc8-9153964ad91a", "sighting_of_ref": "indicator--e86d7c04-5847-403a-9b68-e75e7dbc85ad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41b8d45f-85e9-4e73-a4c2-d5c839301a2a", "sighting_of_ref": "indicator--2904c27e-ab2c-4e8c-9fcc-892304548d66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c47abbe0-6ab4-4788-9a60-4b81550c887d", "sighting_of_ref": "indicator--49322054-2b65-4195-a246-7e36d445ed08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c84fd29a-f18f-4195-ac38-7b72050478ad", "sighting_of_ref": "indicator--487ebe6d-558f-4013-86cd-6a9a4f849c42", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2531b292-11b1-4051-b0c6-982117cbd054", "sighting_of_ref": "indicator--fbb5a1c4-df82-483a-8151-54bd9d79c295", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f188da5d-ccde-438e-9031-5b9f5ad06ec2", "sighting_of_ref": "indicator--d8c9d35c-143d-4f78-8f2c-6bf2b2f2631f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3783ae74-a555-4dc3-819a-664726ce1067", "sighting_of_ref": "indicator--85439bce-f496-4a33-b915-797612135252", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8f05ba8-67fc-4f99-be61-94e63d386829", "sighting_of_ref": "indicator--630b59f2-6f58-438b-b15b-ad991fa3f350", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c795e911-ff21-467a-af00-1aad08d0b592", "sighting_of_ref": "indicator--cdc07dfa-9aca-4ede-a17c-cbc96823937b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9295866a-14ae-4c70-a351-d8c2d9745fbd", "sighting_of_ref": "indicator--b98d5db5-c111-4ca6-ab28-a16c8b4262d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71231d54-3cc6-4bf6-8687-19486ab85a80", "sighting_of_ref": "indicator--0225c311-517d-4485-9277-2b04f1ea2b86", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f16451f-5488-49a0-ab5e-5a52cc9482f9", "sighting_of_ref": "indicator--f17a0548-4e68-4f8d-aa7e-e84969da260f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d78a4a00-555b-4564-a75b-9c20b8a91fb4", "sighting_of_ref": "indicator--7f4f8aee-77b6-4567-87c3-dc031a1c8fa5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46ad2c34-8e78-4f07-bf2b-c29ce028a31e", "sighting_of_ref": "indicator--bbaea669-1c4d-46e0-929a-58cbf5c0d3dd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b657e573-3679-41ff-8f78-83d455109224", "sighting_of_ref": "indicator--ca2f4c09-a5ec-4359-bfe8-646fb00070b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9736822-3bde-48ca-a971-ed6e129f8d8e", "sighting_of_ref": "indicator--4eacbb54-ea46-4744-b657-87a8c64f8e79", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b291994d-bee7-4c6c-9481-5f689fcb6703", "sighting_of_ref": "indicator--c83b48c1-da12-42dc-a1d3-33fd6269f42f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfe755fa-5cc3-4306-910a-45e6ce514168", "sighting_of_ref": "indicator--1f5fd468-285d-4f12-8d6a-6c9e208aaf04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5745231a-8f05-4ac2-a1df-2d3a13c6806f", "sighting_of_ref": "indicator--c32e1a45-1ef9-4d1b-b92a-7d6600a80821", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b4b6d09-7205-49b0-8605-80df50460fc9", "sighting_of_ref": "indicator--192fe54a-5d25-42c6-b719-b2fac9ba743d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ed6468f-0b16-442d-8714-56e6eee96de8", "sighting_of_ref": "indicator--4cae5097-4746-4346-80df-9b7bc35d58a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d74d2027-fdb9-4b82-8c63-9e8559b0a0fc", "sighting_of_ref": "indicator--a7f55520-9489-4512-bcaa-8af471d28e8a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--217fe7b5-be86-4114-aa9f-a89e51062632", "sighting_of_ref": "indicator--6d17b470-ef80-4167-be61-f9a3cd2645d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5f2f43a-5f85-4528-b1a4-4222494b51e7", "sighting_of_ref": "indicator--6f696805-1b73-4fa2-a165-0fac91d04d64", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acdcd1d2-b021-418e-9b05-4df67ba43c09", "sighting_of_ref": "indicator--d77ea09a-3407-4730-9381-c356151cbc19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba615863-b176-4a08-ac59-627d99d467e8", "sighting_of_ref": "indicator--3f1d6421-d07f-4397-bb28-9cf378707e4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--274753c1-72df-4276-b8cf-ae807e5559af", "sighting_of_ref": "indicator--3ffcaf17-462c-45f3-b324-bfb7181353b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2b175de-1ba2-45c4-b5bf-ac2d5bfdb165", "sighting_of_ref": "indicator--86887400-f2f9-4635-b31f-fbe41893c791", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a6da469-ef08-40e7-a674-d5b3af40197a", "sighting_of_ref": "indicator--e3478ee4-566c-4dde-a10c-881130c90fc0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31e1fc48-18f0-4cd0-a516-a5c236476541", "sighting_of_ref": "indicator--e1681c46-e098-4924-a04e-1bd561c1ef34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--275247fd-6bfd-4ef2-9676-8051acc8c15c", "sighting_of_ref": "indicator--cfc65e58-22a5-42c3-9340-f84addfd79b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fd6d9df-c578-4a7f-909a-8cd7ab7a5032", "sighting_of_ref": "indicator--2d7bd613-edc8-4dfe-ae2f-0820f9836e3c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9fcd992-d348-4997-bd2b-ff1d6bbe1762", "sighting_of_ref": "indicator--e8e8d034-78bb-4838-8201-bf999e459094", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cecba769-1ba8-4225-9ac2-1e1a91e0cf94", "sighting_of_ref": "indicator--d4c1f99f-871a-42e8-901d-668976ff7920", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b51e4fb-ad4a-48da-9172-defcfb8b9a40", "sighting_of_ref": "indicator--1778f7fa-72b7-464d-90da-64c2f626c377", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ef399ef-582c-45a0-9c1b-8bee222a9217", "sighting_of_ref": "indicator--00e2802b-f371-4359-89e3-c370afade937", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90e11041-09d0-4351-98c1-3182e82af2c7", "sighting_of_ref": "indicator--f0871e25-fd77-4f5b-bc25-aa0c858ded05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6f69e27-f230-424a-b03d-bf41af9f1a08", "sighting_of_ref": "indicator--e812ad39-623f-434e-82e8-e257a2b871f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3625ce0-3a62-43e9-9e41-3ff89e52fc5e", "sighting_of_ref": "indicator--4d039d04-454f-43f1-b571-f7cd70ff2a15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e533da6a-b827-48a1-9d29-5633c23b1fd2", "sighting_of_ref": "indicator--94ad3607-399d-4590-aaa6-ceb59ff3e5c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec10c571-14c2-47a1-beab-9efd4bdaf368", "sighting_of_ref": "indicator--3f9acbf6-b168-425f-8422-bc74ec45375d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a7c0abc-7b27-481f-a443-306339d4137e", "sighting_of_ref": "indicator--8afa4e86-3ffb-4c91-81aa-e2b4242e8656", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a16d8804-2d0b-4e2f-8d10-d6dc98234e05", "sighting_of_ref": "indicator--048926a9-dc57-4be8-8e71-f08a06d327b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce91739b-cab7-42ef-850c-37ecaca73849", "sighting_of_ref": "indicator--6af677b9-e912-455a-a355-feffc423e096", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffda4b45-ad4f-4108-b3b3-2fd106d73111", "sighting_of_ref": "indicator--69810b6a-1fe0-43f7-82e8-3980b5ee25c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a76522a9-ba6c-4ad7-8288-ac8b849ef65d", "sighting_of_ref": "indicator--24e87406-ddcb-40f7-945d-45b1cb3f9f8c", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf747de4-8d3e-4d09-82ee-e0a8b8f2b94d", "sighting_of_ref": "indicator--e5375661-5544-433b-8c9f-20e6b1de63fc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2ceacf7-8293-462a-9465-fd21ef7a2ea5", "sighting_of_ref": "indicator--998e56db-9fb7-417a-9074-9025835b8d02", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2addfbbe-9abc-4a63-833a-52b080015cfa", "sighting_of_ref": "indicator--651986c8-1c34-4611-bf67-db5eac9abdf8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb3894c-869b-4e02-bc3f-95845ee29acd", "sighting_of_ref": "indicator--b39070b0-2b14-4d25-b87e-c2cd0de05f79", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8c66867-4b82-485e-955d-e2a1936f6a0c", "sighting_of_ref": "indicator--5488ecd8-29d2-4cef-8abe-ca962e9558a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf6fbd19-12b7-4ad0-b012-3de4a5f73556", "sighting_of_ref": "indicator--5f4b1d19-e682-4e31-9c7f-7e2694b6aadc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c34a78af-f74e-4c9f-9253-ba0a7f5e35e4", "sighting_of_ref": "indicator--95b01cfb-d366-474b-8413-6e8b1b6a2e1c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--099839b3-4d35-487c-9809-6aaf3c7f9029", "sighting_of_ref": "indicator--60797665-79b3-42e4-bc0c-5b486e1a9c19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--525d62f5-2010-42be-bf59-88fc8d1bf247", "sighting_of_ref": "indicator--6119a3fe-f1b8-4d04-898c-6fa5a8cfaf85", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--325416aa-a282-489e-9dfe-9b1eb40279df", "sighting_of_ref": "indicator--9a772364-0ba1-4388-b149-924d81a6e0cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5647a17-0b32-4b1b-af46-08539a29ed0e", "sighting_of_ref": "indicator--5f8658e6-3cc1-49b1-aa1f-8fd7b44f6ffe", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf3bf42d-222f-4afb-95a7-23ca6cd7cbd9", "sighting_of_ref": "indicator--5f8658e6-3cc1-49b1-aa1f-8fd7b44f6ffe", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fb541cc-9c73-4aed-8d00-ca6eb2d09c48", "sighting_of_ref": "indicator--5f8658e6-3cc1-49b1-aa1f-8fd7b44f6ffe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b64dafb-a9b7-4d09-9577-9555cbfd0a63", "sighting_of_ref": "indicator--f8080669-915d-416a-a2e4-df6c3956c30b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf9ab611-579d-43fd-ab22-1021d29a1cbc", "sighting_of_ref": "indicator--fc92b175-23b0-438c-92cf-d2a279180da7", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e436c964-c293-4788-a193-faf62ace19ac", "sighting_of_ref": "indicator--9d7d5fcb-a9ee-464c-9634-9c155a5b264a", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32abfd08-498c-4832-8d45-71b49200dc94", "sighting_of_ref": "indicator--e5207d12-a28f-4313-86ed-272ffbca2207", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8e0de51-6198-4b1c-a26f-11d6a89c966d", "sighting_of_ref": "indicator--27e9bf2e-fd1a-4671-8df9-2b4f66257441", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32837c22-6998-4a01-b2e6-dcb4106bfcb8", "sighting_of_ref": "indicator--78bd5768-3c6d-43fe-93b6-155e3d7766c4", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dd2af05-f0f0-4daa-bdc8-c4f10d7e05a0", "sighting_of_ref": "indicator--61febadb-0a64-46a5-b1bd-c8077eeeff3b", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bada466b-bec7-49e1-8df3-f30ec4c40666", "sighting_of_ref": "indicator--0b41a12b-1937-41c4-a052-53d663636a59", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--735f84aa-6ee7-42a8-bd47-0f27975c9ebb", "sighting_of_ref": "indicator--153a2d9f-5e89-43ef-ba6a-02555e8b82d6", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd434a01-1370-40e4-b616-248e37bf8862", "sighting_of_ref": "indicator--ce41a5ce-6e83-40fe-aca5-31e3ba7a2ddc", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03f3ad8b-56a4-4f1f-a2ba-7bf7e186e76a", "sighting_of_ref": "indicator--42f4398a-7735-4898-9825-30a0f3ff1ee4", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d81d0809-9b21-493a-8fb4-e62062ce6d9f", "sighting_of_ref": "indicator--3a05caec-8e21-400f-a05b-372bdc2566a2", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c5ba450-1210-4fc9-8839-2582e280e009", "sighting_of_ref": "indicator--7ef33f84-f950-4359-8104-61268394228f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9877df5-1f6c-4335-adbc-ab237b85acdc", "sighting_of_ref": "indicator--e6cbf10a-5b05-4a51-bb70-ab8d85c2f93b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee460646-b575-4a9b-9b31-f58bda93972d", "sighting_of_ref": "indicator--7b3e84dc-8c48-4763-bf99-e305e61d7eef", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d3b8d2b-6de4-48bc-983a-2ee18661430f", "sighting_of_ref": "indicator--e6fee3f4-31b4-42c6-807a-343d93288172", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2efba60d-6135-4e1d-b4d1-de74702c022c", "sighting_of_ref": "indicator--ac64817c-7c3d-47cf-8096-da5f6f4bb5ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25108526-dc40-4dfa-9531-5498164b492f", "sighting_of_ref": "indicator--94cf3b1a-7312-480b-8419-a83b28ec3040", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8582be7-ecf5-40a0-9b46-20a01ce959e8", "sighting_of_ref": "indicator--cd2d8497-136f-4342-88a7-e0d968a06f1f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e28ab3f6-0937-486e-ac47-298499520b93", "sighting_of_ref": "indicator--4f8f0c8a-aee9-4d2f-91ff-9960f297df2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de9af310-f659-4152-99fe-04469ed9e2ca", "sighting_of_ref": "indicator--a8df8932-7a71-4735-823b-d7368a67dcf9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--544dab60-43f9-4a4b-baec-88dadfad4148", "sighting_of_ref": "indicator--192ae0f5-87da-4443-9da8-203e5a977a96", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a846aecc-327d-409e-bd24-e9478882321d", "sighting_of_ref": "indicator--b85a48b9-276e-4d12-ba91-27756b33de68", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f622cc3-d95c-4b26-96a1-fd134bc1d6f6", "sighting_of_ref": "indicator--8457a39a-d59c-41bf-8f97-b4490d2091cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a4ab7fe-3246-4ffe-8949-4d4517375c4d", "sighting_of_ref": "indicator--9f38462c-6316-4022-ae25-45c53d774dcd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ef7131c-0b5b-44a8-9ded-a3b722ab217d", "sighting_of_ref": "indicator--bfe61eba-8e97-44fd-a78d-f22c23274ee5", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ee291e9-19dc-45cd-a2e6-b63eb3703fba", "sighting_of_ref": "indicator--54fcb37a-1b74-487e-ae3a-51df86406ed1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--081769a6-7b1f-46de-8eef-68f713a76b92", "sighting_of_ref": "indicator--ab7ff8b0-bb1d-4612-aa2d-107994056614", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1416c169-3c27-4fa9-bf8e-1dd3f7fe1ad5", "sighting_of_ref": "indicator--e83a88df-d3ca-49f3-a4a0-8fc4bdbdf682", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb58e014-bdbc-4221-9252-d95e257b3802", "sighting_of_ref": "indicator--ba0570a8-220c-4245-98e8-ab54e3cf020c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ea0c852-4ad1-4f0c-9c1c-f8b0162a6e9e", "sighting_of_ref": "indicator--8acb0daf-1e40-466c-87c7-3521284a53e1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8094208a-919e-44ec-aa5e-7fa68d569805", "sighting_of_ref": "indicator--a3e1505f-3a9c-4dbc-8e72-ee95834210a3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17fcfa81-2e01-4a3c-b983-27a4eb7a5ac4", "sighting_of_ref": "indicator--ce042a64-1732-410c-9f52-fe1afc785327", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48693600-8395-4de0-a464-e0c340ae11bb", "sighting_of_ref": "indicator--eb3f5161-48ce-4f43-8632-5c6c603a9b25", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f83f3c2-0110-49b7-80c6-3dd39a662067", "sighting_of_ref": "indicator--7ea5794f-d88a-42fb-82d5-8a05e6093061", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4060ac5b-8713-4512-956f-0fb988ae8670", "sighting_of_ref": "indicator--c90ecf3b-77ab-4695-91d0-58be2eb5f2dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39cabf37-9115-4399-9788-346c239ac402", "sighting_of_ref": "indicator--29508f0f-c100-40de-a172-6e6576041c8f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0885822c-a0d7-4b47-bbab-ffa1d9d627d9", "sighting_of_ref": "indicator--9f460163-de10-43fe-927a-70e45238aa5b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--915b9102-4779-43dc-ac72-9619c2e1130d", "sighting_of_ref": "indicator--8a703300-483e-488f-a718-be2166ddef4b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0f30bc7-cf55-4d4e-968a-6e9d0b6fa177", "sighting_of_ref": "indicator--ef6e4e85-1dee-42fa-9ed5-2798d607ce7b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e2ff507-b521-47b0-bbba-e4a6f266fd23", "sighting_of_ref": "indicator--c6c1fcd5-f687-498a-aa0d-ac1f1d26e31b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43f11565-5505-42ec-99ef-0e717a8cd62d", "sighting_of_ref": "indicator--b1c2fdec-5bda-41f1-a321-5155ce8148b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fcd7bb4-6567-41f6-bec8-73964594e03a", "sighting_of_ref": "indicator--89bed5f9-4192-4004-981c-0f5e87076bf1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c367510-c2ff-4cfe-bd4c-9849b04eecb5", "sighting_of_ref": "indicator--5ee424b0-88be-4f8e-8705-bfc32453e7a3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37f1ef2e-9589-48b9-8952-61f36a5bcbbb", "sighting_of_ref": "indicator--7f1f64c3-93f2-4d7d-bbc3-8968b08dc8c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8be0243f-ba79-43d5-a86a-c39d0de65724", "sighting_of_ref": "indicator--ca8a8cf9-04c5-4d1e-b2bb-71d35b796266", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a444f5ea-c6ea-4fd7-b6b2-c3b17a0ba1e2", "sighting_of_ref": "indicator--b2b5cda7-3a37-43eb-b2c9-c30c026371e2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f66a0e4-cc9f-40af-ae3f-52df5d187fc5", "sighting_of_ref": "indicator--8cbef57e-702b-4ee2-bc26-4733dab74353", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97874e43-1a60-4654-95df-2874ad1b3469", "sighting_of_ref": "indicator--8645ca66-9ea9-448c-8031-5f1f74407486", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--301c4f00-9503-4b1a-80cb-a8165185196c", "sighting_of_ref": "indicator--8b68674b-61fb-46e4-b18f-965a26deb3c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f4b4ad8-c5d8-43e0-ba0c-0e6598e53535", "sighting_of_ref": "indicator--62bcb09b-6bea-4c66-92d3-0276df8e60a7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80f0465f-83fa-470d-92f8-b1470bb6ae7a", "sighting_of_ref": "indicator--4f4e6b5a-19f5-4de5-aef0-7789c1ebf41d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32eb37a6-845a-4f63-85a8-54cedba230e3", "sighting_of_ref": "indicator--61a95113-5da5-467b-ad8c-8aa8baf66333", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d4d7f51-83cf-4d86-ac51-628b56c729dd", "sighting_of_ref": "indicator--ab790848-65ed-45b5-8578-11847d1d35b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e5e3d3a-0908-4072-9d6c-bc850fce3c24", "sighting_of_ref": "indicator--6388d07c-9a39-4e2b-836d-24d543da38d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74050856-3685-4b4f-9bf9-27f14d1b9fec", "sighting_of_ref": "indicator--d3bbc9ca-a7ec-46fb-b1e0-d78c29cdd5f2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b29cf89-550b-45b8-bf1c-754f7211e375", "sighting_of_ref": "indicator--d3bbc9ca-a7ec-46fb-b1e0-d78c29cdd5f2", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--437c02ec-0bbf-457b-9925-7c2a6bd34ea1", "sighting_of_ref": "indicator--17709478-f098-42e8-8f33-a88d760412ce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbce8f39-44b9-46f4-aad6-93707408d327", "sighting_of_ref": "indicator--17709478-f098-42e8-8f33-a88d760412ce", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c030a1dd-973b-487f-99a6-de009a703b35", "sighting_of_ref": "indicator--1ade2284-9b5f-4311-94ca-149222d7cd0e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30be552d-d524-4465-aa14-513b991a980b", "sighting_of_ref": "indicator--b2bced52-0b13-4db3-9dd7-b2503bc9c50d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374191ec-8b9d-4316-9aa1-122f8088694e", "sighting_of_ref": "indicator--dd99f6a8-b9da-43a8-9229-5b7f42d00d9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14bc7d50-7569-4d78-8b46-b5912ff431fd", "sighting_of_ref": "indicator--0f6a7e06-ab1b-43ac-9ac9-163267d04988", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c29258b-f71a-463c-a8f5-1d6896df9a88", "sighting_of_ref": "indicator--ccbce877-4895-4aaa-9516-b201d3511ea5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9f7f0bd-f3bd-4e61-aff4-34eeb8c7c041", "sighting_of_ref": "indicator--89183129-2e4f-430e-b5cb-8d053d5e2e7a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af93127a-4ebd-4c38-a73a-aef73db61a2b", "sighting_of_ref": "indicator--5b2f4734-9d51-415c-878a-da0a825e419f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c2210d1-13ca-4615-ade0-05282d02acbc", "sighting_of_ref": "indicator--5ac4425c-be9b-4375-812d-615c064350e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e114f0bc-37d9-454a-9678-2aa1b6690d34", "sighting_of_ref": "indicator--d19322e4-3e64-4d7a-b73b-587e2ca74be0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--238b6493-ce5e-4652-9f0b-869c0c0aaa8c", "sighting_of_ref": "indicator--d1a25654-0f72-4a3a-b30a-b2144351ea34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf807624-66e1-45f6-99d6-b27654fa6419", "sighting_of_ref": "indicator--83f95abd-c494-4891-b7fc-391aee505de5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--331540ca-b361-4065-a1e3-74717a8d1671", "sighting_of_ref": "indicator--7dcfe364-c59d-400f-ae22-f1879191f2a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--487ea2c9-b766-4d40-bef1-298ec4d3c8ce", "sighting_of_ref": "indicator--ef15f606-a70e-4260-b316-d366ad6c26ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acb2637d-dc56-4c34-b0dd-f2143330d333", "sighting_of_ref": "indicator--29bc38e2-d2cb-4ce9-864c-2677fc780475", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8c967e1-4278-491b-87ac-f242d8010ec4", "sighting_of_ref": "indicator--4c0ac34f-58a2-4d2a-9500-2f70f963de92", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--971b1630-259c-42c7-8744-1b29cae02e3b", "sighting_of_ref": "indicator--b5aa93f5-2a3c-4eb0-b707-150db758bd41", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--414efa61-96e7-4710-be9f-9b1fd0bbd9eb", "sighting_of_ref": "indicator--7e19cfde-ebf9-424e-a0e4-eb8f79af2f1e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46a9d31b-e66b-4791-bcc6-48059e7f38be", "sighting_of_ref": "indicator--9911486c-3d1c-4722-9555-0a07687ae254", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfc221ac-7457-472f-a258-0eb52b5ab397", "sighting_of_ref": "indicator--ec4a21f6-0da4-4004-a516-9882b85e755a", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d8fcb5f-8f39-4124-a509-271c170be2ff", "sighting_of_ref": "indicator--a884058e-eaeb-4c8b-989a-7d13d7674d2f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2884975-1ee1-4496-aa86-957566beb449", "sighting_of_ref": "indicator--bdf7fbe6-1840-4a69-adc4-82a50c9f91ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65240c22-f86c-4793-8464-41075f7305eb", "sighting_of_ref": "indicator--cd8957ab-1ccd-4d21-80da-ebacd511624c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45d7896f-e94a-4726-a35c-ce63e5da2ea8", "sighting_of_ref": "indicator--f4225f20-6979-42ee-a6a9-64fc67e28ec6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e3279b5-52e0-487d-b796-2644e1bbba45", "sighting_of_ref": "indicator--779edc97-955d-4d4f-af9e-04afe813eb8e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--101813f1-a8b0-42a4-94a1-ed51ce00f0f8", "sighting_of_ref": "indicator--a4822f15-6f83-49b0-8dfb-41df769c2102", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98225d98-4736-4230-9332-02fd838f9997", "sighting_of_ref": "indicator--0391de28-a8ff-495c-88a5-db0132e52434", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0343ef73-818f-4495-aaec-78d4c31c3d0c", "sighting_of_ref": "indicator--267ce3a9-83f1-49d6-8777-e767d22a951e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddd54b93-2cf9-4755-9bc8-71a9500da83a", "sighting_of_ref": "indicator--9b87a4cb-7cfc-40be-b2fa-fd221fe9ccee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7044dc4b-2b88-4742-9f50-686aa86054f7", "sighting_of_ref": "indicator--734d556b-8e4e-4cde-a58c-3c77c6d0475f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb0c0ae8-6486-4ac4-a9a8-e327909d7617", "sighting_of_ref": "indicator--adab0738-3e4e-4650-80ca-b035cda88252", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e52e39d-1c62-4d04-90e6-bb98934a8e4a", "sighting_of_ref": "indicator--ee48b32d-4e6a-49f9-b07d-e7d2ed24e9f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe7131f4-b8c9-44ec-b63b-427f59e4a299", "sighting_of_ref": "indicator--4ccc02bb-8dea-4ede-b56b-e8f3d5777472", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8227d6fd-a1ca-4564-bc05-6e031d8d469f", "sighting_of_ref": "indicator--0fd0bdb7-f444-4374-93c0-a17012d80168", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c81a2028-edba-475a-b6b2-615c4d606aad", "sighting_of_ref": "indicator--35e30e53-24ef-4336-b407-74c0b976f19a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfa56a37-3ddf-4492-81cd-5cf73b9adeb5", "sighting_of_ref": "indicator--439eef4b-e066-45e9-8b25-4a8e850aafb2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9100725c-c6b9-49c2-9e52-bcf767ed151f", "sighting_of_ref": "indicator--66bd4f51-95ca-42b0-b758-f91331a57537", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ab6eb12-5b32-4a85-9a9a-aff522787bd0", "sighting_of_ref": "indicator--6f4b261d-af39-45db-8745-ed2ce329d15c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c531e374-c038-4a7d-b7f2-e35650885a88", "sighting_of_ref": "indicator--798ad6fb-5c35-4975-b0e1-948861f0d6cb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7312958d-4116-468b-8565-3486caec8c36", "sighting_of_ref": "indicator--ad791280-14b5-42ea-9a66-00218fe9671a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5705b2f2-20c7-4264-ba3b-5b6cd986b878", "sighting_of_ref": "indicator--e04597de-47b5-47f0-b34b-c07a4771c17d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05e3dcc6-3f46-469b-9dbb-623d5fccf984", "sighting_of_ref": "indicator--1dc87efd-343a-444f-a566-973b6eb13cb6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--843a27e8-33e5-4948-a8f6-08aafb36dcbc", "sighting_of_ref": "indicator--7e3cc8f5-85a1-4501-8f01-56c74f79ccd4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccd65d48-a1da-4dba-9061-94230f992779", "sighting_of_ref": "indicator--dd83fa24-6cfe-45da-bbd3-e2e86ba5e3c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81469296-88fd-4493-b45c-4b22762b216d", "sighting_of_ref": "indicator--aa7d7aff-e201-4118-aa24-2df9162a71d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0f34a51-f0d0-43f1-9908-e1de21ecc124", "sighting_of_ref": "indicator--14576803-d759-496f-a0c5-1d7e4cd021e1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6917dcae-06ac-4d1e-83d7-482eafc6df4a", "sighting_of_ref": "indicator--d34bb329-1bd4-4b15-8de9-f0feb307aff4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5f38389-281d-4fd8-8c9a-b7946a4ebf03", "sighting_of_ref": "indicator--5bb43a57-e6fe-482a-b73d-63f75bc52f1a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e32542a3-6c87-4493-aed1-fa9e21746ea4", "sighting_of_ref": "indicator--65bbe776-f49a-43e7-9ea1-28588f204bb0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e548fbf1-eba2-40d9-af4f-4e0f95be1e22", "sighting_of_ref": "indicator--a7988d4d-f228-4579-a6b5-4f84e45cf14b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0e0009c-4b4c-427a-a6ca-a4ce8c131bd8", "sighting_of_ref": "indicator--82613d4f-1f49-4bf4-a1a6-e7452b14f109", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68618e23-7c83-468f-9f61-0e49773847e8", "sighting_of_ref": "indicator--9ca4d186-3234-404c-8525-b5607e5574cf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dddc69dc-2159-43fa-9b46-1a2df02ccfce", "sighting_of_ref": "indicator--954262a7-84b7-43a2-abaa-73d9ecebb270", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e508ec83-5f8d-4129-99ab-0346434b571b", "sighting_of_ref": "indicator--6ede2c2b-ab87-449b-bdc1-e2915e307357", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44c5ce53-c904-49ab-939f-cb763add0e02", "sighting_of_ref": "indicator--8d999288-c975-4d32-99fc-c384a6bec229", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d8f5d52-9c18-4965-80ab-83a42104926d", "sighting_of_ref": "indicator--7e99768e-0653-4d98-a554-59d7aa5ef99f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b948ae52-7a5a-4a5d-ace5-7659b0aac19b", "sighting_of_ref": "indicator--76e46e77-90d5-403d-b468-127c36d46236", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a81cb2f8-0963-4e10-82c2-f1b22149cab0", "sighting_of_ref": "indicator--7f11f8c2-35cc-4e46-af5a-b5e62d56b91d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3324db1-af50-4c2e-a96c-dbc07cfdbc54", "sighting_of_ref": "indicator--a9d2b7f5-5938-42ea-bd6f-9a744049af39", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22bcc4d6-1d45-4894-8374-84067dfead26", "sighting_of_ref": "indicator--1cfa585b-321b-4af2-ab7e-df81edbb1dd1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c016cf3-f1e9-4c27-940b-df74f77c0c01", "sighting_of_ref": "indicator--b36f8f84-f663-426c-a31a-536c4f259f69", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d360806c-e1ca-45db-87ae-d5611346eeca", "sighting_of_ref": "indicator--d126baaf-4781-4d65-ae1a-104efcb732bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bbcd7fc-c490-40f4-ad5d-ef3340f335d6", "sighting_of_ref": "indicator--6cb6c975-4db8-4a4e-8034-7d926396fc3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7877eaf8-c10f-43a9-b821-cd49e4cab5ed", "sighting_of_ref": "indicator--f0c7d2eb-1eda-429e-9c1f-e258a18830bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b53f546d-9fc0-4f7b-a509-9ac5016907c0", "sighting_of_ref": "indicator--bbe8a3a7-9084-4f98-8d27-8aab28cf30b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8202fbb8-d815-4486-a6f1-abf7b9aade65", "sighting_of_ref": "indicator--ca47c1e2-38d7-4263-a241-97dc9c5aedfa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8182ab08-4f12-4081-944b-3035201231e8", "sighting_of_ref": "indicator--4b1c70bd-9e42-4655-857e-2afa639272bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c3361c4-7b3b-4e3b-bd83-f7c2f826dbf6", "sighting_of_ref": "indicator--4d50afbd-b550-4f1f-ac4e-a61f66672ea4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d853508-6a7c-4090-8373-9f3b382cbf51", "sighting_of_ref": "indicator--7a429d03-0b29-438e-84fe-e84479d34c3e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4df474a6-125a-40f8-8790-1059833fb3ac", "sighting_of_ref": "indicator--3e3cc3b6-26c2-49c0-a29f-9ddfae5ec3ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b1ecd4f-2960-49fe-8f06-4c4881181f85", "sighting_of_ref": "indicator--e1e0b10a-b0fa-482c-b0d9-82767cca3e03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98f94b83-67b0-4eb2-b3da-025f14af0cdb", "sighting_of_ref": "indicator--a476f6f0-0b7f-445c-b06b-8801736dbda1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d31a07c-7f42-483b-8fc9-cabc40b9d3ab", "sighting_of_ref": "indicator--61bfb8e6-2070-4f2d-8662-cd953c211dae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--749beed9-4fe8-44fb-9032-92a05a125857", "sighting_of_ref": "indicator--200f3ae3-d9d3-4aea-aa74-a567feb1d634", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d29334d-960c-4b86-9416-543b788b7cd3", "sighting_of_ref": "indicator--f4c56c55-3311-412a-98a4-7d73baea43ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a194a6f-ad7c-418a-a3d3-34aa9d325618", "sighting_of_ref": "indicator--3be5cecb-bc00-4187-950a-82dfa93d0f6d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647272d1-a379-4df9-9a91-4ea966b040e7", "sighting_of_ref": "indicator--10c5ccbd-548b-4130-8d6c-ce17f9c11d47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8db8f070-0ef2-436c-a3bf-0be890371443", "sighting_of_ref": "indicator--ce00181e-87f1-4e91-964a-e139e3710fe4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91b140de-5e7e-4cf4-a404-7f9a749a90d1", "sighting_of_ref": "indicator--6a7eccad-7cf6-46d4-b000-6e01b061e07c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--636b7df1-2e4a-4529-b3e5-eae4d1fd3711", "sighting_of_ref": "indicator--6ddf6b86-459d-42a8-bff5-3ebfa8cb398e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad240d50-162c-4b6d-a4b3-b7158ce5c7a0", "sighting_of_ref": "indicator--915a4e7b-dcdd-4da9-b2e9-bf84421ef0a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--519c1afc-77ab-4ec1-bacb-fd95794d5e14", "sighting_of_ref": "indicator--eb21b649-a7b8-48bb-9232-8f5f03ea6e07", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e45798fb-1557-4c6e-a141-8c71857bff32", "sighting_of_ref": "indicator--931b8026-0d20-44a0-9c8f-87ae50ce613a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92eb1686-f015-479a-93c6-e8a681f1c389", "sighting_of_ref": "indicator--5d7ecbf7-1b51-446d-b754-be3e2835ade4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47e1e7fa-11a0-44b9-b1fe-246c85422599", "sighting_of_ref": "indicator--e9b5bbfa-4018-4a96-9903-888043d95c33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8a5f476-6c5e-4511-aa6f-1f184c32ce15", "sighting_of_ref": "indicator--3eeec22f-a82b-4d29-9ee3-cd949008603a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--febd2953-9d5f-489f-835b-628444dbf3cd", "sighting_of_ref": "indicator--4c256511-fa23-4347-b1b8-48ebba1d95ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bea5bfa-a9a4-4d87-8c66-dc0e083d8873", "sighting_of_ref": "indicator--471853e0-8ef1-4964-ab50-ddde93b37e08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b238197-1087-4603-af02-37ad927ab937", "sighting_of_ref": "indicator--60a615d6-4f8a-42d4-b99d-4178a46ab336", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--343819f8-42ca-44cf-95b7-311a5e65e891", "sighting_of_ref": "indicator--265b1885-e40c-4081-91c5-b69993e92f0b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60c26c23-0bd5-4c20-a7d1-d1cecf11c5d0", "sighting_of_ref": "indicator--b25eb756-ccb9-44f6-9d47-55cb248c59f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f75e6032-5ba2-43f8-881b-109cf0a8d352", "sighting_of_ref": "indicator--d4375773-6c2e-4d39-a4dd-390d791970d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d218f27-9b94-4fbd-818a-03170fa26b30", "sighting_of_ref": "indicator--ee488c39-c694-4651-9611-3ccd1690a3dd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9683d6a6-8875-4d17-bb7d-d0fad86db8ec", "sighting_of_ref": "indicator--e49afb15-e5de-4f2d-8483-9e0ea68693bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2af1955b-f69b-4de1-b96c-15583580106a", "sighting_of_ref": "indicator--f5445324-d4ed-4ce2-ad80-5dc087337cd8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37430ed2-7ecd-40c9-95c7-3c79c780086f", "sighting_of_ref": "indicator--60eb5c03-e3b8-4f60-86c5-d0ada6626f31", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d06ff231-dc51-4cec-a336-81957f639ad5", "sighting_of_ref": "indicator--9c8e215f-51da-44cf-8cc1-56590fbaf4d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d52310df-3e37-4822-8ac0-bc752dc0556b", "sighting_of_ref": "indicator--9aa21bd5-052e-49e0-bd23-f193b060f88a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--227c9a08-baf4-4036-ba14-375714251815", "sighting_of_ref": "indicator--4d7718c3-dd52-427e-b84a-072b0f1b903b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ff2170b-59c9-4a06-bf47-d98d7899975a", "sighting_of_ref": "indicator--ebe51895-2cf8-444f-8537-a3f9da8dac4b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de698dc-53b2-4aa5-98fe-0fbca96d918e", "sighting_of_ref": "indicator--5f268aa0-b560-4bcc-bdcf-2a093d8b0379", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b023f5b1-4b4a-4007-bdbe-8a5158f158d7", "sighting_of_ref": "indicator--22d75418-ce2a-49b0-9901-4e0e1ab40d09", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8bab2bf-9eac-434a-bf0c-ded56278dbf9", "sighting_of_ref": "indicator--8e161f4b-7578-4816-9423-3fd292385516", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da7ebd0c-40f9-4537-8623-694f1ed71ff0", "sighting_of_ref": "indicator--81892b3f-71e1-4c21-949d-a1a47c01d1ae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfac0998-da77-4c9d-830c-0b99119483df", "sighting_of_ref": "indicator--aabafc9f-5326-4724-9661-ade18a636e23", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96879b02-3ac3-4aba-a396-7f330fec92f6", "sighting_of_ref": "indicator--ccbe9c8a-6192-476e-8bd9-e56ed8d29d10", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2454e15e-a91e-4112-8945-685c493e95c7", "sighting_of_ref": "indicator--fa05d5c8-75d3-419e-90a4-743f727e9cb8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f36724a-a8c8-4964-971c-0c6026a6e1cb", "sighting_of_ref": "indicator--4131ddb7-1d19-4996-962d-a48c4bf76350", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a4d85c0-96cc-425c-853a-4ee5f316d0de", "sighting_of_ref": "indicator--4131ddb7-1d19-4996-962d-a48c4bf76350", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b67cbe20-e54f-4ac0-853c-af49d70e309c", "sighting_of_ref": "indicator--d605cd47-cb52-483f-aa0b-79788f63016a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d6c6ed0-a4f1-4d04-8ef0-c6a72ad82c19", "sighting_of_ref": "indicator--4f72bb79-e95f-4e16-b918-fa61ebace168", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd4c21b8-55b3-4d70-ad43-a47102b86dbc", "sighting_of_ref": "indicator--76304ec7-ce4a-4a9b-a4c7-c491d916c7ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4bc011d-2539-4088-8db8-44595f0a0b44", "sighting_of_ref": "indicator--538a1e88-fd78-4f20-aa3a-35116e075118", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56acfd7e-9ac5-446b-ab99-820a76a08340", "sighting_of_ref": "indicator--25a1777a-3f75-409d-8a73-62084030117a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c064e26-4c60-40fc-b290-ccd2f5916038", "sighting_of_ref": "indicator--17dd7f64-0527-4c63-8a58-2a3d0e6ffede", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c8045b2-05b9-4ac8-8539-b98785cc0155", "sighting_of_ref": "indicator--88b9ab2c-b263-4bf9-8ddd-f481bec676e1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd2f590-b223-472b-a94b-215eef236db6", "sighting_of_ref": "indicator--99ff9277-9a92-4bf9-a6f8-9386e426cfe3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f762956a-85fb-4ca0-882f-dbe44b374b4b", "sighting_of_ref": "indicator--59c111d3-b71d-40e1-91fc-09ed6a84b3c1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d5822e2-a372-46be-b84e-8d532ef5ba86", "sighting_of_ref": "indicator--9252202e-27e4-4a92-a395-cc56445ef4cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f87a447-3325-4241-91b7-c8bcffad0742", "sighting_of_ref": "indicator--024da3a7-712f-4cdf-8992-638281a3ec0d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5ceb72-783f-4f1e-8fc2-d9d845f25be3", "sighting_of_ref": "indicator--31c11d20-6927-43ae-a976-e96a7490d58d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20e6531d-e955-49ae-aa5a-4312a8508891", "sighting_of_ref": "indicator--c14337f7-9246-43a1-bb21-bfc4196d92be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdfb45ea-c0c7-474a-b521-3484db570abb", "sighting_of_ref": "indicator--8bd686b1-4c82-4c37-bcaf-809c89cfd4b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8468d124-cd14-4a42-b60c-d4bf93f78d46", "sighting_of_ref": "indicator--9b10814f-ba8a-4cbb-ad54-ca0820e9ffb7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--678fc5db-300c-453b-9c54-96b87ca1e705", "sighting_of_ref": "indicator--92938da9-c1b8-4803-8f6d-1b41756da574", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfab85ac-2244-4418-b0a0-da07eea8da88", "sighting_of_ref": "indicator--14d1da2c-1eff-46c2-a040-e7b35a29f3ce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78e983de-7593-41c2-b69a-f5ce0b79ef8f", "sighting_of_ref": "indicator--469a544f-f0d8-4fa6-ad4f-11b9958098d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--516e1bdd-1f2b-48f3-9bbb-41166818733d", "sighting_of_ref": "indicator--e432c6b2-8c39-411d-b211-b5b19054195f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34e238fd-d1ce-4e10-8ad1-1e02df958f6e", "sighting_of_ref": "indicator--2061ca57-bb6f-4342-a5cf-2533b0dec6b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae11b81d-204a-42a2-9997-c14590671b0e", "sighting_of_ref": "indicator--1fb45842-a5b2-44d6-8ed3-018e39150d8a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2037fe7-b8b4-4e79-86a4-4e4e25779fa4", "sighting_of_ref": "indicator--3d2781f0-354b-4d9b-a9ad-3e5be295d94f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7873442-6336-4829-b43d-d962417f9e10", "sighting_of_ref": "indicator--cdd18eac-755f-400f-b0af-c73cc4e30688", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4c314af-6830-4dcf-9f55-19da504a2228", "sighting_of_ref": "indicator--0e73920e-e125-40e4-90f2-f7ec8d38448c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291c7b41-21ce-47a4-b1f6-67218e5cc4fa", "sighting_of_ref": "indicator--1754a0b3-8bb4-464a-bc72-20d31137662b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3586e960-e015-4618-8039-4fc38f26594a", "sighting_of_ref": "indicator--6f3c18a8-aeb2-4a16-81d3-e7803842ddae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bfa8b14-f3bd-4f87-94fc-d4d2a60244ac", "sighting_of_ref": "indicator--40a42462-a98f-469b-9fab-5c21c0075841", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a73bfe1-44c7-4cda-b264-be7800ea4b00", "sighting_of_ref": "indicator--ba9dcc80-099f-43cb-92f4-8d6f4f28e1d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d63a28ad-f4a3-4d63-b4c5-c84e6aadd75f", "sighting_of_ref": "indicator--28c2127c-1f5c-405f-a4bf-47dae713ab11", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68d504af-2048-4c37-9714-3dc0551345d4", "sighting_of_ref": "indicator--4df79293-5479-478e-b587-64090f85de03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--739fb739-4fb4-4b9a-9cef-b0e46ead7acf", "sighting_of_ref": "indicator--ee0155d3-76b2-4103-bffc-52863d92925f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e47e143c-a753-4ba3-9b1b-a9d77712ec30", "sighting_of_ref": "indicator--1a75ed65-4475-446d-b72b-09688d4d59dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5ab77b8-a239-4e4d-a32a-e5edf3b9a6e6", "sighting_of_ref": "indicator--dd98c88e-425f-4ac9-b203-0450db7f0cc9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc257100-4085-40ff-b5f6-7fa60f989097", "sighting_of_ref": "indicator--743a3b69-35a2-4ddc-8e07-c5b6c3da95bd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d129fc30-3bef-4bf6-b9b4-6b3d87246d52", "sighting_of_ref": "indicator--e147dfdd-6f6b-49ff-8e15-9c9bbf10c804", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a733891c-6b1a-42fa-8985-459437404b4c", "sighting_of_ref": "indicator--e72a99ec-8345-43cf-9ee5-75d5a0303d8b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac3346a9-94e8-43b8-9f53-cb409cd256c0", "sighting_of_ref": "indicator--ee308c71-94de-4fcd-b205-31f65a1e9228", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ba339f9-1cf6-43cd-8814-0f0fd8887ab1", "sighting_of_ref": "indicator--5b4dc204-8752-4085-b3b8-90bacdfe6753", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50f98211-f2c8-47e3-9999-54b86a3654e4", "sighting_of_ref": "indicator--6115ae76-fbfa-4502-a3cf-6796314b3c27", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1872f7fc-7e51-4128-aa05-2fd72e77bb3d", "sighting_of_ref": "indicator--07d01e43-ddc6-4c77-b8f3-7e66b04233aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e18c2b79-4e87-4def-8fad-3eb5f883c9e6", "sighting_of_ref": "indicator--8eaa5971-e73a-4f9b-877d-5d99f0052202", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d76d41b-1b9c-4df2-865c-8984a5ff8b5a", "sighting_of_ref": "indicator--3c8dd546-e770-43ba-91df-958ff8c1a742", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0002afec-f742-4985-9f70-e283d8ce1f09", "sighting_of_ref": "indicator--5b2dfa4f-4826-42ea-a1ac-666c7b7704b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60a53f0d-0ffb-49a9-a66c-8773bda37582", "sighting_of_ref": "indicator--f29954cd-ba73-49b8-9deb-959f9420fa8e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df199b86-bc3c-4815-bc85-219034aefe07", "sighting_of_ref": "indicator--81794924-431a-4070-a2d5-4394d8959da0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d68713f-890c-4c15-920b-6bf59214ec9d", "sighting_of_ref": "indicator--f1a232b0-5e44-44cf-b9f6-0dd7d78894ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d478b39-d52a-4db5-8dd3-2bc2a8549c31", "sighting_of_ref": "indicator--55294db6-02b8-4f7d-b366-35f08530c233", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82de3802-f0f9-4ce5-8b9d-660126da9e44", "sighting_of_ref": "indicator--dcf2122d-10ed-4ae7-95aa-506ee8db50c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2224a1b9-1594-48fd-a27b-78c341fac025", "sighting_of_ref": "indicator--836747cf-84d0-4007-b81b-f6e09c6c5640", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d22ddcfb-3ee9-420a-af4f-a3f036d50d9f", "sighting_of_ref": "indicator--70436c60-a6db-447c-b7f0-40353be35cbc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da6bc8de-2e7f-4be2-bcf6-77233d62edde", "sighting_of_ref": "indicator--6182bc7e-4e4c-4cd3-a18d-e40cefcf3e46", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fa98389-98df-4bbf-98ce-7f0e77318ee5", "sighting_of_ref": "indicator--b3d7fce1-62db-4f0e-a7fc-d57013bb7272", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15ba74e7-fbd5-4069-a6a6-9ee206611fe9", "sighting_of_ref": "indicator--dbda1ba3-262d-4002-a89c-11d9ca10a8c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e751cb13-3572-460a-9050-32392c0d01c3", "sighting_of_ref": "indicator--b57af03c-bab9-4859-b538-67491a68f55b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebddc1f1-a89c-4ad0-b334-8fec315435c8", "sighting_of_ref": "indicator--224e9f78-b323-483c-89ef-6b345edf770e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10a7e86b-b51e-4ee4-8343-525099d6f946", "sighting_of_ref": "indicator--36d9a322-082e-4740-ac17-bec307c4284e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2947a828-f5be-46a9-8fa6-8d6cfe7c08f2", "sighting_of_ref": "indicator--952da9dc-96e1-4a70-821b-e94df9691683", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cedb105-d230-45f0-af5a-44f0037bcdd9", "sighting_of_ref": "indicator--c8ce1e43-ae69-46a3-b11e-3af36f5b32a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4bb8930-9739-4bc4-a866-cf8b70f8770f", "sighting_of_ref": "indicator--30e70771-f6fd-45da-a8ff-8f6a880f2943", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--820130ba-da5e-4c29-8a8c-519b7fe049dd", "sighting_of_ref": "indicator--d6789107-c0ed-48cc-8691-f290d2965225", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9782d0f-0648-4928-8e2a-eb86ba25ffe9", "sighting_of_ref": "indicator--867b7911-2cd5-4dc2-9e99-0e858479c4c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89e3c550-9a1e-4a9d-8bb7-b866929a6517", "sighting_of_ref": "indicator--a17230af-3188-4a47-a41d-7a3c15c49707", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aa398f0-cb1c-4a29-8cae-62f547761bde", "sighting_of_ref": "indicator--5ff25973-13aa-4f71-b8a4-0c14c5761904", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4e98399-ea13-4d92-90c2-518703f94ec5", "sighting_of_ref": "indicator--4a758c7c-9a13-4be7-924a-22d7d8848ab1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16d9a5cd-1413-47ce-9c3b-bd5ec496f2cf", "sighting_of_ref": "indicator--7d88d000-e5cb-40ce-90cf-0640d85e01ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7f412e4-93bc-437d-810b-5fe8f8092fb5", "sighting_of_ref": "indicator--80cac1d0-1fcc-4f06-8b6b-8a5e80d9792b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44b2116b-dd98-4894-96ce-07cc8b97db42", "sighting_of_ref": "indicator--6cdc88a9-22ed-4afe-80f6-e18fb3377f43", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db128791-a76d-4a90-931f-a0098ca65370", "sighting_of_ref": "indicator--b52687b6-1704-4f65-90f9-069b61c94b9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61c77c88-4209-4f33-8268-6f8318996780", "sighting_of_ref": "indicator--5d969ef0-2a07-470e-8258-a0a1780fbfbe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03b2a5d5-7593-432b-975c-1c2294c35438", "sighting_of_ref": "indicator--d97e5012-c509-4705-9a43-3bdb046c6f14", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b7b6126-33e4-454d-9c70-ac0d9f1b9186", "sighting_of_ref": "indicator--505de3eb-b233-4059-a4dd-27752039742a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72b92983-c540-4dab-9e36-3a2321e13b6d", "sighting_of_ref": "indicator--442ca244-8dd0-4782-ac03-bc1bfe81922c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2834b0aa-d09d-4c34-979a-8a5209720d69", "sighting_of_ref": "indicator--0b2bca7e-d385-4f08-9d2e-51dc1ddc8bd2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf2beb4f-d1d7-4156-b897-794108f39095", "sighting_of_ref": "indicator--8f22ce72-2f06-4601-b21d-eec41f64421b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71b1787b-6ad8-49bd-9bc7-bd76c00adf8a", "sighting_of_ref": "indicator--89bf2572-66ea-4586-a311-cd4bbc249a28", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35ee5828-0bc8-42b1-97a7-96221ce2fe43", "sighting_of_ref": "indicator--ec2c2fda-44f4-48ed-b6bc-d01e3f4aa85b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c747a9e-1d2b-4ced-9a9b-36d5c559fa5c", "sighting_of_ref": "indicator--6205fd59-0da8-48c0-920e-c22879b9c433", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3059d08-e0df-4925-a456-ec26d5f56915", "sighting_of_ref": "indicator--ac44754e-e6b3-4731-8595-36c7bbd20b56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21bf0453-2112-4750-a198-193c51b41272", "sighting_of_ref": "indicator--3eacd8dc-e4d7-4ac3-bce8-d172df2f8925", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dca5864-4565-4bcc-8bac-acfdab6e4771", "sighting_of_ref": "indicator--9e996ff6-f2d3-4133-af57-f44059081e28", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--167c574b-4a76-49bf-9a49-4ca7648cd16c", "sighting_of_ref": "indicator--19174e8c-6522-4386-8838-e3ae2300ee4b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd2d86f8-828b-49d2-9cd4-a22ff4bef0d4", "sighting_of_ref": "indicator--133a6e1d-eb2f-4cdb-8691-35a61fc6c191", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f7a5116-5bca-4e78-bd45-0b094decfd0a", "sighting_of_ref": "indicator--b8a7be94-64db-4952-a010-a48bd1527421", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9c469ce-4134-422e-943c-1d883ac04a22", "sighting_of_ref": "indicator--942d159c-625f-4b2f-8779-f93005d6d95c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2da00f0-9ab0-4501-99c1-7ecb89afedc0", "sighting_of_ref": "indicator--8aada716-f625-4379-b62e-8ab48b327b7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb109194-e1fc-4c4b-a5e8-772a58d378c0", "sighting_of_ref": "indicator--1ea03b9d-8a8b-48ad-82d1-d8886010e322", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fce85c5-1bd8-4625-a205-7dbfa3d85df5", "sighting_of_ref": "indicator--f4a4164e-8f04-4461-a64c-fd72d0916490", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db19c7bf-e08b-407c-96be-d2b874c845a3", "sighting_of_ref": "indicator--b4c30776-00fc-4cd9-bc7a-9b02fc7773f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8c8019a-160d-455f-aa1e-155729973729", "sighting_of_ref": "indicator--a53ea11f-361e-4dfd-90be-5edf4d8e6d44", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e3ea871-7e1b-4bfa-bbef-3ddb5d677a96", "sighting_of_ref": "indicator--1cbd5cc5-4ca4-463d-9855-7274eabeadb2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8afb7ce2-1f2f-494e-9338-cc8eeb6411da", "sighting_of_ref": "indicator--3d3a3608-9051-436d-b4b9-987b7930c540", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f143c4-6901-459c-bbc8-d3bac0e06969", "sighting_of_ref": "indicator--aee10bea-c48f-40bb-b870-566a975b4dad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21a3e8f1-9ba7-4cc1-8131-2bac8e441e50", "sighting_of_ref": "indicator--cbd97549-ed9d-44a3-afd9-243e7138ab9e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51ad1bb8-8837-443c-afec-0c4cc9b8184e", "sighting_of_ref": "indicator--e3fdaeb1-9b8a-4ca9-8aba-f11918d8f6a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6150cda0-e9cc-4aa1-8998-635b3bbb0fd7", "sighting_of_ref": "indicator--4a7e0d27-5396-4225-bc4d-ef71693ab32c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9f62bc4-630c-4d6b-9b68-3566031e86ef", "sighting_of_ref": "indicator--13ebfe83-8679-4af3-8d34-6bb43a9b2ac0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--006cd42d-b925-4657-8fe4-8b332d8a246e", "sighting_of_ref": "indicator--652d4839-c7ee-4617-a836-a31274e34779", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11ad1e84-b91d-4909-89a8-a6d0703a1cfd", "sighting_of_ref": "indicator--31959d21-cd7c-4038-82f6-df697c80e5a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f72e39f0-192e-4e02-9c38-c8e5f5fc8292", "sighting_of_ref": "indicator--67c73a33-e4fc-40bc-8cad-45bb8b0a405f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e29a209-4397-436f-8c8c-54bc9612dd26", "sighting_of_ref": "indicator--21ebf07a-4385-4e9c-9ac2-8c60056ded37", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2edf644a-73e4-445f-9ba9-6bb371f325ed", "sighting_of_ref": "indicator--d732bb29-9081-4b97-9d69-fed2382dc125", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1e8e20d-a670-44c6-bf60-411417ada291", "sighting_of_ref": "indicator--932216b2-c77a-4d18-95c6-e322a6c5863f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4c1e93c-d533-49e3-8d36-34fc4d47fdb5", "sighting_of_ref": "indicator--3aa44c85-cfd0-4187-8f9a-17b43272213d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddc09021-1a9d-4e90-bbac-16cb86e1969f", "sighting_of_ref": "indicator--64aeb511-9eb9-4d79-b7ce-71e083674aa9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71f09e56-5478-4e48-9e29-ae36aa7dd556", "sighting_of_ref": "indicator--98f63de0-59a7-4161-83a6-bd434e80b350", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6def25fc-3240-4a94-9c3d-db19a9610d89", "sighting_of_ref": "indicator--0648c262-9556-4233-98e1-0ae85169493d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62e8e9c1-1b91-4d6a-b46b-c2a4b00bdd83", "sighting_of_ref": "indicator--a3c4f388-75a0-4fd5-b823-18429d2bcd93", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6606ace2-d093-4f87-b65b-9764f8c58859", "sighting_of_ref": "indicator--3ed6bdf8-96f8-4c6f-9a08-4f28747ca2be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--011838b5-77a4-416c-bc93-e06ad5c7a3e0", "sighting_of_ref": "indicator--3e615c7f-436d-4335-9b98-c6beab703239", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e0fdc6-c385-405d-a65d-e92358a902b4", "sighting_of_ref": "indicator--79ff1dd5-471c-4c84-b17f-5a4fa3a0c6ba", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe593023-47f3-4874-a157-42d2a817db8b", "sighting_of_ref": "indicator--2156a569-9174-4e28-82d6-7c5a2352150d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--460e883e-c977-4fb1-a350-130af6dcd10a", "sighting_of_ref": "indicator--25c948b1-9371-46c3-b1c9-7f88107f0cef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7435122b-990d-4c20-8481-b95487cac1b2", "sighting_of_ref": "indicator--9c31395e-8b83-4209-a6f6-784282912f0f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--397a6250-c134-4573-8891-96ad3739c996", "sighting_of_ref": "indicator--51043921-cc58-45d3-979f-7c8d391d2110", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baf08241-c064-4158-91f1-a2dbab1e8753", "sighting_of_ref": "indicator--afe89360-c253-4306-88b6-3d1f18c1bfc4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ca04de8-8f00-4ba5-b078-71a20bfe19a7", "sighting_of_ref": "indicator--af596983-51df-4d8a-a4b8-2633e25ca9b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae2ea5d5-1b96-41d6-b25c-cb3d5cb6d3d1", "sighting_of_ref": "indicator--3f2a99b2-0e34-4291-9a83-29e44f91443f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a87726c4-0ab9-40fe-bce8-3c95701317a6", "sighting_of_ref": "indicator--b7cb1bb7-66be-42c9-906b-93275089717c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efb1dd15-afe3-4d8f-89af-8363c268adc7", "sighting_of_ref": "indicator--c074c711-c1b0-4927-9473-0fb5fd8f41bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed501c67-e0b1-4c99-be76-4746c2f17577", "sighting_of_ref": "indicator--b5da8f85-afb7-462b-8caf-e75289401278", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51ccaff5-bf1c-4555-b22b-73590a25fd85", "sighting_of_ref": "indicator--1b4509b1-fd59-4e91-8375-01ff4127836e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7cb257b-772f-41ed-b9f5-2edec5cd0c33", "sighting_of_ref": "indicator--7386a67d-291e-441b-973a-79dcdd79f860", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef6e5814-7633-4362-a213-102b81c9bf57", "sighting_of_ref": "indicator--4afd5ec3-a568-4284-add7-b557923ecca5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f73b5ab0-6827-4d11-a86e-d40d6cee78a3", "sighting_of_ref": "indicator--39ffd6fd-d757-4ac5-b915-9aab7afb51a7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5c3cb7a-929a-4846-863b-5f92eee5214c", "sighting_of_ref": "indicator--fc579aa1-d648-47ce-9504-848c9b60f8eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--516c8a1a-eab2-4512-8bc8-66d14ae64fb3", "sighting_of_ref": "indicator--e0f543fc-1f1e-4e18-8cea-2ab412ed64eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae4f305b-e83f-4533-990d-54526c93cfa9", "sighting_of_ref": "indicator--c6d450fa-0751-46c9-8d39-885912edfbfa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2020416-ca4f-4594-a000-191ddcbe89b8", "sighting_of_ref": "indicator--fd5b1c84-7577-4dbd-8a13-bce1e078d7b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94aa8fb1-5797-4e55-af90-5b385752a5f8", "sighting_of_ref": "indicator--f93ff5e5-2b2a-427c-aafa-8aba877a6c95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbbedc61-20c5-4d25-ab41-78100e01c57c", "sighting_of_ref": "indicator--e45e42ca-27cb-4997-aefc-501610faf764", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22504b0a-ef1e-4cfc-8035-cbf7f3bbb517", "sighting_of_ref": "indicator--f57e1028-1669-4723-bb32-7bc8f0b2dde0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b06f4319-bd12-4e4f-8d97-dfd0ce88be42", "sighting_of_ref": "indicator--188fbe55-9004-492e-8170-af76e4c6e18c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4ea1b57-8a4c-48ca-b462-5b35b3bf7e36", "sighting_of_ref": "indicator--a5617d4b-43c2-407b-a222-7824976cb1a6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39947445-6205-4bdd-bf7c-c639cfac7396", "sighting_of_ref": "indicator--2fce43e3-7735-49ed-972a-d6fc1c74af84", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3826f7-88dc-47cb-a0d9-03f30479ada2", "sighting_of_ref": "indicator--9cf60c68-4210-43e1-810b-09458014f2fe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e143e8a-5c10-41c1-afa8-2beba969a0e0", "sighting_of_ref": "indicator--01644201-5b15-4a00-be37-c3840a804209", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00e52825-b7f5-4f1e-8930-cfaee102f2ec", "sighting_of_ref": "indicator--b7872b1b-5385-4873-b2f7-d337cd2dee69", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d4ed85b-76ba-4ddd-9c4b-baf53db016a4", "sighting_of_ref": "indicator--ff4ebc78-c9f0-46ba-9c91-767f692bd783", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afc8f02c-edf0-49c2-90d2-c5d6a9354855", "sighting_of_ref": "indicator--ff4ebc78-c9f0-46ba-9c91-767f692bd783", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0b0c1cb-e01b-4136-851b-07d32a38bc42", "sighting_of_ref": "indicator--ff4ebc78-c9f0-46ba-9c91-767f692bd783", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99cc8b89-0e24-45ca-9acb-1cc8a2dc429b", "sighting_of_ref": "indicator--5e0d61c6-2bd4-4f9d-bf09-6dd4e438f5f4", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a28265ce-e601-4f98-8018-0016c0720e68", "sighting_of_ref": "indicator--5e0d61c6-2bd4-4f9d-bf09-6dd4e438f5f4", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5182bc8d-c176-4ad2-ae41-824ebfdcc6a6", "sighting_of_ref": "indicator--5e0d61c6-2bd4-4f9d-bf09-6dd4e438f5f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae7824af-398a-4301-b35c-04803a0404bf", "sighting_of_ref": "indicator--b9fca2b0-84d4-4c9c-8b3b-1dd87ab9bd62", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bc5f6f8-527c-4279-b078-18ae057c382e", "sighting_of_ref": "indicator--b9fca2b0-84d4-4c9c-8b3b-1dd87ab9bd62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd402b91-fc5d-40cf-a23d-d0b7d440556c", "sighting_of_ref": "indicator--c48f78a4-e5e3-4da0-a986-4dda67eab0de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0f0c6f8-8e19-4a7e-81f0-246b2124a1a9", "sighting_of_ref": "indicator--91b79aa1-d429-458f-b06f-c03516712eca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef4c8096-b002-4f32-a30f-45a4be8a8439", "sighting_of_ref": "indicator--1b26c99b-b995-4328-bbc2-3ae5ed020fa4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91b917c1-0501-4cbb-9025-191076fc4605", "sighting_of_ref": "indicator--a6cf857b-4792-4a47-a6cb-abaaa48aaee1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5de4ff01-4fb3-4420-9ec3-b61c1ba9e3b3", "sighting_of_ref": "indicator--2b716fbf-eb03-4863-ab58-fa80a933255e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18e2b230-4eb7-47a1-87c9-09cbf7e63410", "sighting_of_ref": "indicator--85e1bade-3bef-4b88-bd67-4f0efb8290d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cb14a32-5dce-45cb-a758-ed73e2a50613", "sighting_of_ref": "indicator--4bc01751-3fe4-4c97-a8ac-e022fafd05c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be48391a-18ee-40b8-9f15-f1b646b321f6", "sighting_of_ref": "indicator--99d17507-eaca-4f01-b6fc-f840004ec010", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fac73220-c40b-4464-9ae0-1a1941a0e470", "sighting_of_ref": "indicator--e2731b9a-6ab2-4b12-a4d0-012695852db2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15d26917-5bc0-4861-ac21-1fa1d698a7a8", "sighting_of_ref": "indicator--bb74b31f-9b56-433c-9724-834308f2f0ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1022982b-9e02-40bf-89bb-e01260c2bfa1", "sighting_of_ref": "indicator--ce9738ad-ae66-43d7-828a-06e9a5d71d55", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd768cf3-17f1-421b-9667-dd605bfa24de", "sighting_of_ref": "indicator--59c544f2-1950-41a3-8432-b8b12c604a2d", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--655201d9-3d49-4b91-9e60-81a7db241868", "sighting_of_ref": "indicator--c6173a51-6fbb-4587-9929-79d54d4a362c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c73d962f-5c18-4080-b7bb-6c8bdcf599de", "sighting_of_ref": "indicator--6b703334-06e1-4edc-a114-a45d005e5b5d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86355b53-26c7-4072-8912-0499c43d12c5", "sighting_of_ref": "indicator--447cd953-8976-43da-82c9-75351dcea670", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e11f7ebf-2789-4c9c-b685-81a992cfa097", "sighting_of_ref": "indicator--595de877-702a-4e35-9b3e-aaeeef12bc6b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--133237ca-c477-4494-be84-c042422c7899", "sighting_of_ref": "indicator--e13448a3-906c-45ae-a859-40ffe552e958", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e4c1146-ae17-450a-86fb-c0b2ba526d1c", "sighting_of_ref": "indicator--708ca607-bd57-4e47-b5be-ba8b26a6ff69", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2084281c-a995-4bdf-9467-21df9b09efa0", "sighting_of_ref": "indicator--79b8183b-f2fb-41b7-8a73-2f01ef57fc64", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf606809-fd5f-4376-8db2-eb96aa6fd19f", "sighting_of_ref": "indicator--2e72a5e5-0b59-40ae-9e12-de6fdb2fe7e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41391a75-3334-4e18-baaa-68cf06128f49", "sighting_of_ref": "indicator--f7a82141-2041-4f4a-9d61-5c20cc271bdf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b9be4c6-ebac-48af-8e61-b6f03631872c", "sighting_of_ref": "indicator--601160bf-66f6-4911-8628-5d544ca7d636", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed9335b6-ab3c-4f64-a622-43797e42e3d6", "sighting_of_ref": "indicator--8307aaf5-8af3-4321-9bbc-b977c0103b42", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--947f3b39-49e7-4eed-9fe3-462e0710c4f4", "sighting_of_ref": "indicator--02f4a236-c0f1-4d81-8cee-58acbd0727bd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c601fd29-9f34-413d-baa6-c0af19b70efe", "sighting_of_ref": "indicator--5794cf87-7b4e-439c-ab82-59bff4e6ce6e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08067afe-1f84-4423-9791-50d37ee0dbd3", "sighting_of_ref": "indicator--0a41cbb6-dd6b-4c3a-8849-671ee8afe320", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f13eaf14-36d0-49bc-8e80-a573c44192f8", "sighting_of_ref": "indicator--5ac7521d-4775-496f-889a-1ad8c5d84aef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae057f31-d0c8-4ab8-b160-883e05c83edd", "sighting_of_ref": "indicator--57207e62-a36d-4979-9e3c-2de20f73ca90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b38ce90a-dc50-47e2-b625-054c1448b156", "sighting_of_ref": "indicator--5658fdd2-6a41-4625-a8f0-5f0c39f7c4d6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13c154ed-137a-433b-88fe-c3634efc4366", "sighting_of_ref": "indicator--b76bfca2-882d-48c4-9df2-c6baab612ba3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--428dff4f-10c1-4e39-b29e-69702ad652e1", "sighting_of_ref": "indicator--a9be6cd2-295d-45b4-85fe-fb236959247b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f8af2b4-cf7c-49c6-a7d8-5c5861b662f6", "sighting_of_ref": "indicator--2e3fd61a-46bb-4aaf-a985-833fe921d9c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--606737c1-cab8-4830-8b86-81f87dc0f69c", "sighting_of_ref": "indicator--3908264f-31c9-4449-8918-352c0e03b1eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce4165ae-0ec1-4458-aae1-ff40604701d5", "sighting_of_ref": "indicator--684463e8-237c-4f2f-be2e-c57fefb848a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65318fd4-f866-45a4-9d67-127efa078d59", "sighting_of_ref": "indicator--760b2c21-147d-4f9f-858f-10a7c724cb04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2785dfde-9bba-4490-ad65-a1bf152ef8b8", "sighting_of_ref": "indicator--7bdf10f7-8d97-4428-998f-ef8699652efb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fd8997f-a09b-4a64-800f-dd6a693dcb71", "sighting_of_ref": "indicator--ba2e87c6-0f15-43ff-b6a2-db791a9a2d86", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1206a07d-6aeb-4a24-931e-c7d5a5407096", "sighting_of_ref": "indicator--fca12c00-50e2-4f40-b080-b78856a1e5b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0c34a72-eee3-4f1b-a5b8-d959cd2d30b9", "sighting_of_ref": "indicator--3c43c05a-cac2-49f2-95c9-ca77f5c45b89", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caa60a30-65a7-4902-9c7a-66a43eeb88ac", "sighting_of_ref": "indicator--71168f56-c5dc-421f-a3d5-ce12284066d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95767e56-9493-4168-a24b-cc17f01a7378", "sighting_of_ref": "indicator--2edebc2a-6e1c-4de9-ae9c-871cd4f3c751", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cd9bbfd-c3a0-4ed2-b73c-6f5ac043d253", "sighting_of_ref": "indicator--c5fa65a2-769a-4ee2-bd93-fd2018edeebe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e933fde-ee53-4c16-87cd-2ff8aee3166f", "sighting_of_ref": "indicator--95cb27a5-6102-49ee-8e39-edc47632fed1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eee61c59-06e0-451b-b1fe-71c4102d7ece", "sighting_of_ref": "indicator--7ff70d0e-e6fe-4981-8beb-4b39b75c5f2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43d3b02e-f970-4e9b-87be-9eefde930f39", "sighting_of_ref": "indicator--265def3a-894b-4dc4-8a0a-f872420c2a39", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e08ad9f-caac-40ca-946d-f16c6c6723d9", "sighting_of_ref": "indicator--162bb02c-7f72-40ce-9925-68e8d69354a6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--190930dc-c646-4bac-bf26-21b5e1af1be3", "sighting_of_ref": "indicator--45956697-0644-4a7d-b802-0d125cb470d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b30275e-e59c-4cad-92b2-f84384fcc684", "sighting_of_ref": "indicator--d3a5c8e5-e481-496b-9011-dd714f48aabe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b57157e7-cbf2-400c-bf99-4a9e77d9b0fb", "sighting_of_ref": "indicator--75098ab1-8c3c-43ba-9aa0-5ea7b7325789", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e6831a0-4c30-4e08-a69c-fb075589222b", "sighting_of_ref": "indicator--103a6800-d3aa-4fc2-98a0-36ffe182d311", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a2437c7-9942-4437-9a3d-90ee744d9a5e", "sighting_of_ref": "indicator--49b814c2-12b8-4fb9-ba18-b090fb95a9d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--117fa934-6a38-422e-b782-9a09e4093ddd", "sighting_of_ref": "indicator--f201b28b-6c87-4554-8b4b-462ff743331d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb6ce0ee-16e0-4c02-9905-e0915bce4e90", "sighting_of_ref": "indicator--4cab6e12-3a6a-4966-9ad9-713817d7134c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d56d8b1b-9fcc-46d0-a26c-bb72918454ff", "sighting_of_ref": "indicator--31cf870a-3e13-4bc2-81d0-75756e6bf083", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe9e7549-063e-44f6-a580-3bb3b997d5e3", "sighting_of_ref": "indicator--53d1ee96-9d90-4da5-923a-94ea38cd1959", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2947a3b7-392e-4c27-b82d-33928f093167", "sighting_of_ref": "indicator--ab9890eb-bb62-4d2b-892d-a50560276fe3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c397fee-545a-4b5e-8232-a8ce6e73600f", "sighting_of_ref": "indicator--a908a25e-3f21-473d-8999-30676c7e4b91", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e88ac8f-114b-4ef5-b039-cefc8d5a8ffb", "sighting_of_ref": "indicator--26533069-763a-447d-8a0c-eb574150c657", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae0b560c-133c-40c7-9d51-418b110b8826", "sighting_of_ref": "indicator--08ebf3e7-fe0f-4f5f-acf9-4d088a0cc63b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0848358c-0e0e-4089-9ffc-92b7d1471acc", "sighting_of_ref": "indicator--f1e99c7e-47c1-4ba9-a78b-25c61cf6cb83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0c10fef-715e-419e-8a30-94ca669f2684", "sighting_of_ref": "indicator--a5ecb944-a9cb-4fb2-80fa-0480b50095e1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0fb2833-3015-4402-9646-caebc59b5818", "sighting_of_ref": "indicator--7c1f08c0-ad56-41b8-8a1e-9c1fedd6c824", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e311ab7f-1c71-4992-91c1-dbf174c298a6", "sighting_of_ref": "indicator--5ed1274b-df27-4899-8b08-c92f526a2a8a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15b23d17-bb96-4b2c-96ea-689908d695aa", "sighting_of_ref": "indicator--2946127e-43d9-4b80-aff1-be6aa86e995c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--994eadc0-a5ae-403e-8836-44a45ea0a063", "sighting_of_ref": "indicator--55fdcb5c-0b34-4d6e-be8b-b94c6389da3d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35a8a022-2cb8-47dc-8b95-f64c1db8d92d", "sighting_of_ref": "indicator--ba75d95a-1d1b-457b-b364-a8451568f21a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ce18704-2e7f-42ce-9ed9-697f75f78951", "sighting_of_ref": "indicator--2184bdea-251b-4f7b-af07-58e37bc4d16d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea848b61-18bb-40c7-801e-55db8b92bf5a", "sighting_of_ref": "indicator--09f6305b-8935-40ce-9724-826d95a7cc9f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46ae7f95-6251-4348-9ae4-a31da02ee377", "sighting_of_ref": "indicator--08d1795e-8ff6-4635-8b36-793c2a3f801e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--198c4f10-94a8-43f7-ba84-1d794d9a26bc", "sighting_of_ref": "indicator--51352634-0cdd-48d3-8f45-a776e77d34dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f30e21a9-cb7a-45f9-ba0c-7dcd893d44e2", "sighting_of_ref": "indicator--3da8b0a6-d815-4317-81e3-c7db41150c24", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--240a12c7-f958-4be0-9da7-adc3100b4c6c", "sighting_of_ref": "indicator--8e5e20a4-056b-443f-92c1-0f9a10ad906e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f70a4793-d9f5-4e0b-9e39-2f340932e756", "sighting_of_ref": "indicator--8099e89f-3b9e-4cc0-890c-bdbcfbd588d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df97aea0-d6ab-48f7-89c2-8091dbeb8c0e", "sighting_of_ref": "indicator--92c96067-1ed9-4122-b8c7-e87e33cac97d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a25ba1f-1ac2-4b27-9ff1-abffbdd10ea1", "sighting_of_ref": "indicator--04609238-aa44-473e-933d-ebef6f6e4111", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e83604b-e4d4-4792-8692-2043d7d32dd8", "sighting_of_ref": "indicator--a404da52-9e61-4b30-b832-b975d8d2932e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5bb2c05-c7fa-46c4-b1a0-aeaa327eb0a0", "sighting_of_ref": "indicator--29e337a6-49c7-45cf-8e36-7056c745a245", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82bfcfb1-7da7-4617-9a50-5056e3518b26", "sighting_of_ref": "indicator--99139760-42f5-46c3-9536-91ea6c415bf5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--926c1178-3114-437b-8916-39792e27ad26", "sighting_of_ref": "indicator--70d43237-9360-4c3f-b063-a8f089249ed8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab5a5897-d003-40d6-a4ad-11b43ebf95d6", "sighting_of_ref": "indicator--470f74dd-751a-4aa5-883b-8b55e1c5b0a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eef6bc4e-88b6-4022-894e-04a8b20fd899", "sighting_of_ref": "indicator--1bec9308-fe24-4b1b-a4e7-85383bf6b091", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3007bf0-04fa-4807-aecf-cb22ffebcd5e", "sighting_of_ref": "indicator--75a27cf5-7db0-4dda-a5dc-a771a3a7e714", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bdb282b-cd00-4184-8ec8-d9f49fdf773a", "sighting_of_ref": "indicator--30aea0e0-7efd-4988-a742-ca47023af04d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--127e7c5c-d191-498c-9111-68ca6a7e510e", "sighting_of_ref": "indicator--68e3b520-2601-4a3c-a8f6-40952fbc4a77", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0448a172-413f-4089-93d4-01dd4cf2ee80", "sighting_of_ref": "indicator--11399f88-8f3b-4ed7-a473-171552ddf656", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f4e383-4de6-4998-b5d6-38fb9c1aee0c", "sighting_of_ref": "indicator--b2a65fe9-25bf-4422-b9a2-ee503104985c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82321648-7125-46c5-b436-ef69a5fb9d28", "sighting_of_ref": "indicator--9233dff7-84ed-4286-bd0b-6bfceeea55d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e7b5b2a-bccc-49c9-9af4-151711311ea2", "sighting_of_ref": "indicator--54ac013a-3cff-4d16-9d23-73dd34219a87", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea0bfc4a-43ec-4071-9bf3-baee836c2ef5", "sighting_of_ref": "indicator--ec6697c9-b850-45e9-a173-40ac03e50bfc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c633eee-6a3a-4a46-a223-b2e9fa88078b", "sighting_of_ref": "indicator--f57e7a05-d6ff-4d95-a1ff-c9ced9e8d45a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54de2a27-b508-4c81-993b-42ffbe15c96d", "sighting_of_ref": "indicator--ffe14fe9-9718-4f86-add2-afffa5535c94", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67eb6ad3-a68e-489d-9ad7-7b9f76a804ef", "sighting_of_ref": "indicator--76097a75-8a4d-4f19-ae98-762394ccdc2c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50ba64f5-a754-4c84-a303-6864dc7ea3a4", "sighting_of_ref": "indicator--cf9fe11d-e348-40fb-8b67-d7bc25a33fd9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cc4621b-ca88-452d-a1b3-7b6caa4e87af", "sighting_of_ref": "indicator--e06f3e34-bfdd-4ceb-8879-5cf7b44827d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a389961-51cf-4bb7-9ca0-e89d62f9abcc", "sighting_of_ref": "indicator--08fd0e5f-92f4-4f18-8a4d-2777eddefea9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eac0282-60a5-4322-a1bd-7e969ef25c59", "sighting_of_ref": "indicator--e3a27cf3-9e1b-4cda-9321-3c839a98e2bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a6d1e1d-9b4b-4537-8bee-09a055961ab0", "sighting_of_ref": "indicator--6c237045-1f92-4c8e-b065-c76d8001919c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b40894b8-fa87-4ed6-b95f-38d9f4b7d203", "sighting_of_ref": "indicator--7d12d45e-1c8f-4e46-abfc-612bd0553d46", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e124d35-3c7e-4584-9fd8-887d4471ada6", "sighting_of_ref": "indicator--9b7a22d6-c2cc-41e7-9720-89044ca3e0b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8a96795-6f0b-4f60-bd52-92bb1421b0d5", "sighting_of_ref": "indicator--8c163643-df1a-44fe-bebe-4a7abe53bcc5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f7375d6-9fae-46a4-ae46-834e797dd512", "sighting_of_ref": "indicator--400de7a5-9a62-4a30-a2d2-5c342db71660", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8edebe66-55fe-4024-a790-96a3c21525bf", "sighting_of_ref": "indicator--32d61a2d-1c0c-480e-bcec-520f331a7e32", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c30dc98b-34df-49ab-8b78-74f69aab297e", "sighting_of_ref": "indicator--00495f08-a8b0-47e1-91b1-c74e6ef3d4ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07b26a86-f895-4a0b-97a9-4a71a2e3d44d", "sighting_of_ref": "indicator--ba734a18-53f3-427f-9baa-42f13d7b5ed9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9443382a-d3a0-4bfc-9581-3730f15f6b5d", "sighting_of_ref": "indicator--d8748dae-61d8-40e5-96bf-4cdd6445273a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7fda3cb-9f9e-46e1-bb10-f9307ae4f0e9", "sighting_of_ref": "indicator--d5f4c064-9de2-4b97-856a-b4ac79cb37ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29839796-def6-4650-b54b-77dd8cc05a4b", "sighting_of_ref": "indicator--3f4aa4b3-194a-411c-be9c-dfb0a173d50d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6b60276-07f1-4829-ac61-8066c9cd2833", "sighting_of_ref": "indicator--5e46c048-e1e7-4165-aa03-759278aa5f18", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fbada2c-e97b-4a5c-8019-16148aa8680c", "sighting_of_ref": "indicator--1868720e-d1ff-47cc-99b5-17aeb32d7423", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8b90073-5bfa-4245-9701-4ba5afab92f6", "sighting_of_ref": "indicator--09e0b591-ff03-4909-b7db-db91ee5495ad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a553c771-a20c-4aa1-b87c-c085c5fcea65", "sighting_of_ref": "indicator--61a656a3-5ad7-410a-98f7-f20cc3c42d31", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80b456c4-eb20-4add-9aaa-485b210c1b93", "sighting_of_ref": "indicator--7c693e50-3748-4d22-aaee-38147331a454", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a25ef76-af38-4fc1-a527-fa54a2823b8e", "sighting_of_ref": "indicator--b8b71201-4734-4273-9d2a-df2ff5975348", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa3b7014-4f6f-48bc-abcd-3c8f70162c0c", "sighting_of_ref": "indicator--4f89a6d9-9952-4e4d-bd49-fd65e7dc4bb5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c51f162-7e63-4128-9e86-3f883a04a97b", "sighting_of_ref": "indicator--81e595f3-1605-41e4-9a8e-44b42680d299", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc341e49-23b6-4d89-a347-e4506eaf3e98", "sighting_of_ref": "indicator--06b3d916-0550-49a1-938b-771808335e7c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--845757fb-6db4-426e-8aea-14b406045fa9", "sighting_of_ref": "indicator--f1a4d79e-1a72-4423-a6d1-1e56a0c9790d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--740f17aa-a558-4727-884e-2fcac5fc2aad", "sighting_of_ref": "indicator--e1bba601-2540-4739-81ee-b20d5fbd7324", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc8d324e-56f9-4067-9512-1e3c94c54dea", "sighting_of_ref": "indicator--fe8ae3b2-bf15-4eb2-be19-1bf4ded41d15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0ec84a1-ba6c-43f5-b600-3233f93dc759", "sighting_of_ref": "indicator--66c38275-973f-4772-932a-f2e4d7c8e813", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eef043d-348a-4dae-be90-9085c663a31a", "sighting_of_ref": "indicator--451572af-645c-44b4-8ab0-dd67b3fd39f2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9b0daa6-e739-450b-9cc9-da047d181e3c", "sighting_of_ref": "indicator--c2747714-774a-4c33-834f-0e1f817b6d20", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4784c068-c9f1-4521-a6e4-272ce83adeac", "sighting_of_ref": "indicator--b5c36ee9-eadd-4e65-bd7c-78a5d05b349a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5e7beb3-4114-4e60-aec5-589779913da0", "sighting_of_ref": "indicator--4bfd11d6-2a2b-4e7f-a92b-4dff323ef3bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b371d590-e321-412b-a934-fdd9be80a2a0", "sighting_of_ref": "indicator--f735b2d0-e4d6-4da6-8568-0db5388bb5a7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e943d514-3f78-45f1-887d-90ba6eeb3f79", "sighting_of_ref": "indicator--3f004378-486e-45f8-922f-de92bc6a2755", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61080ce8-956c-4e82-8e03-f197ac0afc59", "sighting_of_ref": "indicator--b51093e1-07c6-4b43-b2fc-ab4c3f7f00e0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e679846-5d79-49c1-a3e2-e4fa5e2c78a9", "sighting_of_ref": "indicator--7721272a-3a95-433b-ade2-5cf94855b5c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39595bdd-9731-4ce2-b08c-4f899c6a72b0", "sighting_of_ref": "indicator--aa29fcfb-2dd3-4de0-ae7e-cfd0802d6b34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77ce16bf-50f3-4b42-a3a7-4a3d6b0971d2", "sighting_of_ref": "indicator--f7e2d7d3-15e7-4dec-b0c0-eb58d7818467", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0154248-49d9-4052-bf01-73ac8af8d1c3", "sighting_of_ref": "indicator--27a7f8d6-6986-4433-9f13-7a0d53b64ae5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e61e05e-25ff-4217-ac02-e065b467c4fb", "sighting_of_ref": "indicator--4d457c9d-8b00-4b0f-80d4-6a7baa27eb7b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a92faaeb-65fe-4ae0-a2cc-b4ec56aff7f9", "sighting_of_ref": "indicator--1df02a47-8ee8-427d-9768-1360d290261c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3031472-5faf-41af-b599-d3e07dd67251", "sighting_of_ref": "indicator--874a1c99-821c-4461-936d-dd913f48c927", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73daefb6-82ac-4fce-b8bb-2f83e9171450", "sighting_of_ref": "indicator--5876851e-a428-4eeb-818f-c74a88a20888", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79162fa7-1e67-406c-93d6-57cc3d735161", "sighting_of_ref": "indicator--717d0d8e-4069-492d-8e86-649f0feee69a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76ed4892-7811-4651-ab88-4778ac80a1b0", "sighting_of_ref": "indicator--fc3060a1-eb0d-41f0-9902-96f609d9b4b4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9112067a-91d8-4ee1-9f2b-cab6b8b1f7a9", "sighting_of_ref": "indicator--3aac52e3-13b3-41a5-9130-68c414af2f6d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b1d328-fba6-4b8b-8ade-3a51806dca34", "sighting_of_ref": "indicator--f3504109-ad26-476d-8e17-761bda99ad1d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5e14449-45b1-45af-97ab-6c523caa2dee", "sighting_of_ref": "indicator--98d43f90-b8a8-4103-96c8-9ca061a2ded0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3995fbc-c061-47e2-aebf-cbc8d54e15bc", "sighting_of_ref": "indicator--12843008-1f4d-4ac1-bd96-31f1bfac05a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fddacc5-b7ff-4ca7-9912-64132c27fa7e", "sighting_of_ref": "indicator--bb0735ef-4fd9-497a-85d0-e226546b946d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4645a13b-95d5-4680-bb99-8cf9f4e9ad9a", "sighting_of_ref": "indicator--2fd3aa56-da98-4813-a138-f887095bb9c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--078da5ab-ffae-4c42-b406-3c907cb9a73d", "sighting_of_ref": "indicator--46bf6893-79fd-4cc1-ab59-b358aa520219", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da0c0384-1549-4410-b71e-5536a8b549a5", "sighting_of_ref": "indicator--d4d75952-ecb7-4c43-9233-635c672d95d6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19354d23-a484-42f0-8fbd-236b394f6d23", "sighting_of_ref": "indicator--9e10d716-cc60-4e3d-9b81-61b88df26691", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88a9d1df-b1c4-4a62-8a95-3bf04fe49b5e", "sighting_of_ref": "indicator--d461defa-4bd9-465b-966a-d5f552960f4e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95c6a6e5-7675-49b6-bf45-a1aeebfebcf3", "sighting_of_ref": "indicator--0094b14b-6370-4bff-81b8-282e05236d7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c1cb17f-b15a-4e2b-8690-c51a77ec6229", "sighting_of_ref": "indicator--2de06874-a169-48bb-9257-504b73126737", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9efb19c4-f85a-4b3e-a192-a4d7f13469f6", "sighting_of_ref": "indicator--03a571ca-f79f-4517-a16a-0595ac5fc92f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ea05a33-3c32-4f0b-846e-1ecffca5571c", "sighting_of_ref": "indicator--3ae9a950-5285-4fd5-8820-b07acc731f2e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2e59e27-5125-48b4-94ce-8de14a64135f", "sighting_of_ref": "indicator--8e783fdc-0ce8-41fb-bb63-9b661b80ae98", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6d5b763-15b2-42ab-bd11-a507f7db760d", "sighting_of_ref": "indicator--6c1ceecc-db8c-46b0-846e-adc9b9a704ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b147c12-d098-4db1-b574-9d9c2cbfd283", "sighting_of_ref": "indicator--f202469a-ce1d-4e98-8ad9-5b8d10dbc6e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1d5c7bd-1336-4c40-a2d6-d692ec0ff709", "sighting_of_ref": "indicator--7d5b47eb-481d-464b-b22b-06923dbba825", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7c05320-f3ac-41b9-b815-90a3a882cea5", "sighting_of_ref": "indicator--2b1f3489-cec6-4a0c-a66a-eb68f9373b0a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--907f8a11-9b50-4108-9a6e-8fcf018b567b", "sighting_of_ref": "indicator--d7961dab-f884-4711-a54b-cba40323de15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4307068-0fd0-4c2e-a084-ed203bdc2fd6", "sighting_of_ref": "indicator--ee5feef8-3d6b-4c69-852b-5242202b34f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebda5c1a-1b8c-43db-a4a2-47aee6196537", "sighting_of_ref": "indicator--6835b770-2e02-4605-a3a1-063de12e4247", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2640eae6-cc86-44a1-86a5-49a22a0575ff", "sighting_of_ref": "indicator--088948b2-d9b8-4393-8cd3-4d7bbeedf422", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7edd67ec-0ebe-4509-9900-dd9856d653bb", "sighting_of_ref": "indicator--a2824593-d52d-4e4c-962e-09c7d3fe6bbf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be1a8fd8-c829-4851-83d3-7c18211f83e8", "sighting_of_ref": "indicator--1af2f7ed-8c92-46fb-98c2-f216e499a160", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--410d4e95-deb4-4431-821b-93fddb8e1397", "sighting_of_ref": "indicator--ef778ed2-cf5f-484f-80ee-9eb86c61fe3a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69eccadb-50f6-4ed3-9d81-6906712b4cb2", "sighting_of_ref": "indicator--3644c0b4-a1ca-4436-98c2-03e503bac5ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--115a1926-56e6-40e6-8aef-3af35f7c8bbb", "sighting_of_ref": "indicator--574b45d9-4958-424e-8bc5-40cf4800f151", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d14f5902-6bf7-4b0f-93bd-0e829dbda4ae", "sighting_of_ref": "indicator--174f985c-6c9d-447b-866e-0bdc1da2f8be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6d97b1b-238e-4d67-80ad-64d2cae83759", "sighting_of_ref": "indicator--efdb2e2b-d40b-409a-9678-8ad574649542", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b85cec3-149a-4dd8-848c-939d08df3f9d", "sighting_of_ref": "indicator--5f589726-5a5b-4672-9cb8-72b32b54652e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f721c3bb-51de-45d7-8e15-4b604f6c5b24", "sighting_of_ref": "indicator--ae9b9f38-d83f-4de0-b279-d4f3a5207b78", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b56a3e6-be40-4af5-b89c-bbc9596e3fb3", "sighting_of_ref": "indicator--a0c560aa-44a1-484e-968f-5c512b1a7b1b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87df4289-ce83-4b1e-a2ea-9a45830e1fda", "sighting_of_ref": "indicator--ffc2be34-b665-40bb-97ce-6c4918535708", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aea1da41-35d4-4b5d-90d3-a4c6bd9f6a60", "sighting_of_ref": "indicator--9f65bcfb-c9ae-4a81-9118-37e2c38138de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4be70f2a-ca4c-4258-9c5f-f9473990aa26", "sighting_of_ref": "indicator--773c6038-70f0-457b-8e95-03c51e001975", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5fa60e6-e397-4903-96e1-8facf17a7507", "sighting_of_ref": "indicator--2a3af906-f8d8-4de7-b477-15828fb3d0b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdba77c7-5e76-461c-a354-406d8c4c729a", "sighting_of_ref": "indicator--7d5e60c0-ee04-404d-a3b9-9e65cf22475d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c870b51-fbfb-4c97-87dd-25e962706aa4", "sighting_of_ref": "indicator--855815a6-9aa7-45ac-a635-d995c536b604", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7529f64e-5b41-4ae1-8c22-c602a3b81251", "sighting_of_ref": "indicator--a7e74532-838f-408b-8a1d-62e5dcadd693", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ecb5ba1-7967-45c1-8699-50a82d2fc340", "sighting_of_ref": "indicator--c2729bed-8f5d-4932-b0e9-7d80e8f1c4a1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d01c0eb8-6824-451a-b438-62eed8416c9f", "sighting_of_ref": "indicator--152d3303-77bf-430c-a2e7-99d37800a8c1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a103d386-5c9b-4aad-a4ea-0d90206a151e", "sighting_of_ref": "indicator--e5edad2c-6075-460d-934d-5aede25d8072", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c86584e-2d31-4d9b-ae4b-0a1412f2354d", "sighting_of_ref": "indicator--e5edad2c-6075-460d-934d-5aede25d8072", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6812f60-a77c-4b84-a97a-2c8e15ca267d", "sighting_of_ref": "indicator--72c4a1e9-afa2-417d-96c2-0e03216548c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa39ee5-349a-4671-aca7-365f9be1e08c", "sighting_of_ref": "indicator--01d21be1-3213-4607-854a-41953bb8b003", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dc6bce9-6984-4652-9fbf-f43947970d85", "sighting_of_ref": "indicator--8bd41191-37de-4481-8427-188ae3c39a25", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c3780d3-9f3f-4ec0-81b6-c49bc0735893", "sighting_of_ref": "indicator--755b6777-4628-4854-b837-5f1bad0c1b1c", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c8ccd15-82b5-4457-9ba6-77c3153169f1", "sighting_of_ref": "indicator--32d96c35-1b0d-4411-9707-62894b82fe63", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f2d0f2f-5e84-4d33-a893-4910d79d834a", "sighting_of_ref": "indicator--0b22aa06-97fe-4e9b-becc-195ac8bd7643", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b46b3d1-b9ab-47e0-8097-59d19c56ed23", "sighting_of_ref": "indicator--3d0e7287-72fb-43b8-94f7-af1f4a2c4e80", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13f56d6e-1537-462f-8dd9-900ded7e2aff", "sighting_of_ref": "indicator--21b10ed3-7122-4445-a133-838e373054a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--424ab883-e218-44f7-a021-46aa2c8adb9e", "sighting_of_ref": "indicator--8bd2c366-6134-4a5a-9b9d-d8e7077ed713", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dfbfcc8-9075-4f55-b122-7ca7acd23cb4", "sighting_of_ref": "indicator--44a5cda5-db54-4169-bd26-2d9dc140bb6d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbfe4bf8-5ecf-40f1-9fb2-e2584190f7bf", "sighting_of_ref": "indicator--67a305d9-37ec-481c-b516-b20f817000fc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4448d2f5-ee2e-4483-b5d9-e03a90fe0452", "sighting_of_ref": "indicator--ae0e897d-48f7-45d4-8e5b-6452c09efed1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d5bbcb1-910c-4dc0-a787-24d42e2f5ae3", "sighting_of_ref": "indicator--742372ac-2778-4ddd-8499-bb7a537aefaa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23a4baa0-4090-41f8-b3a0-49863d3f4dc2", "sighting_of_ref": "indicator--ba35d60c-a6f7-49eb-8529-30d40026497c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73dc8b4a-f08c-4c05-b61a-e3b2f1dcef2e", "sighting_of_ref": "indicator--ecbf78fb-fa6d-4d88-b34e-e77334a3cc3c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b86ce0eb-d4cf-4763-8630-6625c411a584", "sighting_of_ref": "indicator--c0fd1ce2-cc37-462c-a3c2-faacbe5d0e25", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc918d42-7b27-4733-81ce-864782c7c273", "sighting_of_ref": "indicator--94459b43-ccb7-47ba-9f7d-5dcf71a58fbf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--138d1db5-8f1a-4861-8078-aa157d45bcb4", "sighting_of_ref": "indicator--17af9369-a686-4645-a9da-aec4038b2e85", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--050d2489-62dd-4883-91b9-74ce0eb7b95f", "sighting_of_ref": "indicator--00c65003-c2a6-4e6c-87d4-48a2f1188882", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--102129bd-b71f-4dd2-aa77-6de056459b57", "sighting_of_ref": "indicator--6035e22d-3b74-4e38-896d-bed289e557f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8486a3f-85a6-4f2f-ba44-628159385a3f", "sighting_of_ref": "indicator--5be2176c-90a9-481d-908a-adb2096bbcb8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e247c30e-b2ee-451c-8551-dc8ffa62607b", "sighting_of_ref": "indicator--684f0ea6-637b-418a-beae-cc99da36f18b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7765a2eb-859a-4838-b218-67e6582d62f0", "sighting_of_ref": "indicator--a2e8efd4-a62d-495a-ac6b-b86744c61e3a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e2f32d4-2f70-4c87-b9fd-cd558b8d7282", "sighting_of_ref": "indicator--ef28f82a-5095-4dd2-a458-5447a2ceb95a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f82685ad-98e5-496f-ae3b-2cb25590a872", "sighting_of_ref": "indicator--faf253db-7edb-4b9b-86fa-58887d5de0a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ffe82ff-e885-41a8-a60c-02a30beb5741", "sighting_of_ref": "indicator--308c10cf-80a2-4212-9d03-9adfbc4fdd61", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b00bb0c4-26bf-459c-91d6-aa214941a106", "sighting_of_ref": "indicator--b7e82584-15f1-4ac7-bc61-5d47d33bb7a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f47f9b24-c4db-43e3-bb04-2fdbc9a07ad8", "sighting_of_ref": "indicator--a1558409-4594-4276-9b15-5aa57b20da7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4d4d669-c011-404e-927a-2aff77fcdbcf", "sighting_of_ref": "indicator--d9812ce2-76da-46dd-a041-3ee4513d83b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b656b7e1-be01-4f51-9669-43f7609be1bf", "sighting_of_ref": "indicator--aa959cbe-b4c1-455d-b293-6ae87904837e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3d2c14f-042a-4877-bd4e-01c0fd1802c1", "sighting_of_ref": "indicator--d680448c-d367-43f6-a764-c470138634f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c56991f7-55e7-4535-b584-6c0e10047079", "sighting_of_ref": "indicator--36684a3f-0cd3-4622-b783-767b5d2c7d51", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8fd132d-78c2-416b-8341-e6f15962a437", "sighting_of_ref": "indicator--631953f3-8c3a-4631-9f93-2a272aa70133", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58016a5a-3b97-499c-ae4f-90dfc64fc968", "sighting_of_ref": "indicator--49c964ff-e81c-4750-a96b-966264654c4a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68fecbe7-e372-458d-a1fe-c8d189a8786f", "sighting_of_ref": "indicator--c2c77a65-4a26-48f5-b8d4-7342c7f0de76", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fb35953-535d-40fa-bda8-9959c6ebd8f9", "sighting_of_ref": "indicator--05c06e37-6278-4cfa-afcc-fa0222ccd079", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6115f64-d6d2-4c0a-be29-88bcb586adab", "sighting_of_ref": "indicator--54355444-6697-42bb-ac86-83fc02598dc9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--255ec559-1b94-49d9-a7a4-dbe03c48dc10", "sighting_of_ref": "indicator--f7773595-765b-4654-b3b8-9b35591c96e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52354ddf-9b95-427c-9f8c-8e14ca412b5f", "sighting_of_ref": "indicator--2b51a462-c5cf-469f-bee3-85e8242cc6f7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69c4c94a-9a0e-481a-a4b0-dacca99756b3", "sighting_of_ref": "indicator--f82912ef-3345-4879-a4dd-1cbbb2962240", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8545b3c0-fa16-41fa-813e-8977ec97e673", "sighting_of_ref": "indicator--400d71c0-3927-4d0f-b61d-c283d27c45e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00dbea31-777f-4388-81f2-ba79e47cc07e", "sighting_of_ref": "indicator--c4956a0b-ef58-4e59-aa07-48ef78202c72", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--689c6db9-08b6-4844-8e61-282a31e8d985", "sighting_of_ref": "indicator--2b2ecd2c-2d80-4a95-8e0a-32b2ff5379f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd07a9cc-4cb4-482c-888d-56ab258081e9", "sighting_of_ref": "indicator--a7886c36-1917-419c-a046-4a23a073980f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4178618-3924-426e-91af-a9ff5e72438a", "sighting_of_ref": "indicator--aae07765-cbbd-4de5-bce8-779bf3769af3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ea5a6c-7e8b-45ed-8291-fa7e276a4df3", "sighting_of_ref": "indicator--3c90aa33-2306-4972-ab48-01cabc72d13a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef2b3938-7d95-4a99-9557-645913ca0360", "sighting_of_ref": "indicator--ac014cf5-16f1-4455-b6e2-6add6d30e092", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e490b12-95e1-4ea5-b18e-08e89119f983", "sighting_of_ref": "indicator--48087d92-016b-4783-b6a4-08397744304d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de121b8-919b-4584-8717-d4c486c099d5", "sighting_of_ref": "indicator--842192cf-9c72-4eb5-bf6d-413b9685427d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d444112-372e-469c-a708-aa1a6620a136", "sighting_of_ref": "indicator--931f23a3-1aa5-48a5-bdcc-cd82f9881936", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b063fa2-d376-4f23-8976-3e42da2b652b", "sighting_of_ref": "indicator--7be77acb-5b3b-4b07-9f9c-b7b82fc2f2fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb051d3-223b-434b-bedc-dda30523ecb8", "sighting_of_ref": "indicator--39106b9b-f8d6-4631-ab1e-ccff2e5cea0b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8bc6656-cc5b-49c8-acfa-6f33fb0192d6", "sighting_of_ref": "indicator--6423b586-f693-4072-90e0-8f08a0779013", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f06e834-8173-4c10-8744-909ecd7101b6", "sighting_of_ref": "indicator--1486a36b-e12e-418d-ab3b-5c833f062f50", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a541cb9-2d3e-47b9-80f8-4daaae9d4733", "sighting_of_ref": "indicator--08f00c73-b2b0-44f7-b55a-c55d215e0dc8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17da215a-fd3f-4207-b24c-8ec162189d50", "sighting_of_ref": "indicator--dcaa74f6-f98b-4203-8845-82323646ea51", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f46890ab-fb89-49bc-8fe9-b3daed171d0c", "sighting_of_ref": "indicator--5b35e9c7-a25f-4492-958d-edf5e65e119c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7e054d0-2477-4e7f-9995-c47741b90189", "sighting_of_ref": "indicator--832f2453-f643-4f26-9f08-908a6fe2fa95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcbbc8c8-1aee-4d25-81e6-ce0239a014ec", "sighting_of_ref": "indicator--f87a1172-1795-4267-b0e4-64cc16350038", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--473b8204-ca4e-4083-9638-3f033cf5d302", "sighting_of_ref": "indicator--995c48b0-bcb9-45d8-93d8-d807c48b3d90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e43bbc22-74a2-44d7-8019-65a50793bc36", "sighting_of_ref": "indicator--5b77ab62-05c4-46da-81f2-edb5ae1eefb9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1615b7ce-f382-4f39-bb77-7089787aa4d0", "sighting_of_ref": "indicator--020715c9-c655-4f63-8c3b-3a3b507abfd4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37c718bd-22fb-4d0f-9726-ad1a31fd2554", "sighting_of_ref": "indicator--de642dc4-ccb7-489d-a516-d24e77fadaaa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--040c6866-dc42-4918-9c1a-6ffe7d8f77fa", "sighting_of_ref": "indicator--7c8a6405-391a-4020-bfce-a8be77fd9335", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80d66394-ae1f-429b-9bfb-22f1d3fe99cd", "sighting_of_ref": "indicator--6b3a1bb4-12b4-441d-90c7-a805ddeeb538", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76f184b8-bc76-419b-85c2-208340b2ac84", "sighting_of_ref": "indicator--bd2a7018-19a0-4ef9-9eb8-875bd5a27e25", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3543d3f4-8ac0-4d29-adb5-81844ce6e252", "sighting_of_ref": "indicator--0dd14325-9d7b-4b4d-90c0-38fc488e988f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7937e2b5-2596-4816-b3e3-7bb6d079f05f", "sighting_of_ref": "indicator--fa0c22f5-14d9-4787-b2c1-d8eecd9e5d62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--123f4368-7de4-4390-bd5d-0226007a1894", "sighting_of_ref": "indicator--b9c4331f-435e-4996-b46d-d94f19c3972f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fcda29f-21a7-42f2-95c6-18dedb836918", "sighting_of_ref": "indicator--d86fb2be-a110-4745-baea-166e8cb9c6d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e9be05d-a57a-4855-9dc1-09dee47fb540", "sighting_of_ref": "indicator--035e55bc-4214-41ac-b5e6-e240f65697c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16b6026c-33d3-4c3a-8e38-a46432578efc", "sighting_of_ref": "indicator--daa37928-71d3-403c-aeef-e4f742184144", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92d153d7-4221-4434-a670-7e3d935e8026", "sighting_of_ref": "indicator--44fa56eb-bf58-41b0-9b88-6a12222d1d9e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c03e750a-d7df-4a53-86b2-c32860d6b7ca", "sighting_of_ref": "indicator--5977a814-ec7c-4208-85e2-1d892330bbc2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2ed75bc-289b-4001-82ba-cae76172cfa3", "sighting_of_ref": "indicator--6cf2d777-d887-4a79-978e-cd4d6c7ce4c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e99eaff3-d698-47ac-a997-0d8257af321f", "sighting_of_ref": "indicator--e1f71ec5-0545-43e7-950d-15fd07acaefa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69b42ef0-cff8-4ea4-b976-c6e1785176e4", "sighting_of_ref": "indicator--ffa21e37-bf40-48e9-80be-eeda9cf68074", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--309ef52d-5c5e-43a1-a84f-a5a634abde44", "sighting_of_ref": "indicator--9729caa2-c10f-462b-8daa-aef22868e814", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2fa22be-1f73-473b-b91e-336cc5de07d0", "sighting_of_ref": "indicator--2fb000a7-676d-420d-9a5e-c4eb6b89decf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb84992-1632-4151-b0ec-5b0b60500675", "sighting_of_ref": "indicator--002f22bd-c7ff-4e8f-a780-21d8178ed4ce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1630cf6-4452-4f04-8b30-6972f09a096d", "sighting_of_ref": "indicator--8c606a0a-e1c8-43cb-95a0-93ca0f9c1a2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a919dd35-51a9-45e4-b73a-1ec568335278", "sighting_of_ref": "indicator--03ff045c-a6c9-483a-9699-183ac293da78", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69d2618d-7169-4810-963a-4896e157237a", "sighting_of_ref": "indicator--fe804592-a23b-49a5-830a-5a9f363c3b91", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11ec7e3e-6558-4d1d-a870-91c6e4fb889f", "sighting_of_ref": "indicator--532b9f71-cc8b-40bc-955e-26f921fb040e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcdd8a4d-7fb6-4e2e-8171-dacb9668ca3e", "sighting_of_ref": "indicator--ef2763cc-97cd-4410-b65c-af46d54edf6f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e909df5-bbf6-459e-8114-65212db3121e", "sighting_of_ref": "indicator--140bbdb2-80c0-4e16-a004-db6e053408d2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--932b9478-f86c-43f2-87fe-a1c7cc71b8cf", "sighting_of_ref": "indicator--6f944c8e-9eae-49d9-abea-5082ff25d856", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eadc66e0-3fbc-4d4b-baed-bfd0be67689a", "sighting_of_ref": "indicator--4fd0877c-aca4-47fa-b9aa-a9670932a912", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--917b9e14-a84c-4af3-b1ee-7925a0d75a40", "sighting_of_ref": "indicator--8ae3fb15-97b0-477c-8903-ae0c70b53448", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ce6d1ef-8f34-447f-8a77-a4a822272351", "sighting_of_ref": "indicator--af551427-55f6-48ec-9b5c-cfb98d1cd0b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd607052-03cc-4f45-b4c9-04a97a23999e", "sighting_of_ref": "indicator--687ce4d7-be4c-4759-9695-27df379aa1a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f46fd77-353b-499f-9b20-ca351636c270", "sighting_of_ref": "indicator--bdda9181-ec87-4c9c-b66f-af4f1a5d3833", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3337d882-4e06-46bf-b925-1768536652f5", "sighting_of_ref": "indicator--2f61b5ec-650d-41f9-8f57-de7dfc7afc7b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f962fc7-7631-44f8-82a8-27be046e81f1", "sighting_of_ref": "indicator--374ecf16-8d16-4235-ac3d-4e0534a56e42", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7267a938-6caf-43ef-b579-4620109d30f5", "sighting_of_ref": "indicator--7df0f133-1b8f-4849-946c-0f8a57866eb6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75c780d4-a455-4cfd-8ff3-1fe173730f42", "sighting_of_ref": "indicator--44d50467-d0cd-4b24-9854-7145adfca20b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a81e552-2f88-4c4e-af99-17f8ac6af8dd", "sighting_of_ref": "indicator--2c3c46d6-52d3-4c12-ae30-a8f289cf76cf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10b607c0-9e12-462b-a572-f27e64457dfa", "sighting_of_ref": "indicator--2b0e1724-887a-431b-bd9f-4f104082ed70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53c9bac1-b493-476c-90f9-33be7b129c16", "sighting_of_ref": "indicator--ceef18b1-0d40-4c90-ae25-2158d2ec666c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70e7e14b-4c75-4c1f-9934-c56bc1248ca3", "sighting_of_ref": "indicator--b2f2ae3d-a126-4ed6-a244-c2c6fd0208f9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--506d2d7a-6f95-4502-9044-b1d11a049b73", "sighting_of_ref": "indicator--d98f4fd9-81ac-4800-a428-05dec8cca612", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1acc45c-3818-443a-9d2c-d6d085ff8c96", "sighting_of_ref": "indicator--e809a8e5-a4c9-46c6-943e-e8d083561655", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--719977e8-f432-45b7-9b6c-e2d4a6d8a00f", "sighting_of_ref": "indicator--9e07dbf5-c410-4c44-8a34-845002d055cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea84059c-0321-45bc-a5c9-7e883b407757", "sighting_of_ref": "indicator--0bb1dd72-5a34-4b27-98ab-d43b0162b200", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffca8452-6017-4977-9a72-337ef761b093", "sighting_of_ref": "indicator--414f3789-cce1-4e10-8505-8dd45c11326d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fed6e79-9740-428e-a01d-d5119bb7c382", "sighting_of_ref": "indicator--3f2d83dd-8c0e-4204-a91f-05425541a064", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64fab9bd-f5e0-4a38-9726-45ee00dbee9b", "sighting_of_ref": "indicator--249f92c4-679b-4153-8d66-ea512dda48b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f043decd-68ad-473b-8968-e8113a9bb931", "sighting_of_ref": "indicator--29ac7703-4d8b-41ed-af62-ae369c9540d2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--801f606e-115c-492a-bd89-69098d6f170b", "sighting_of_ref": "indicator--c685f1eb-962c-4828-81ee-b1c18bd94837", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae630cb2-b7ae-41c6-ae7e-8cea938c6159", "sighting_of_ref": "indicator--6cf5384c-2ab2-4eb4-8403-12186343a466", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fb5909e-9f4e-4c6b-aed3-fcfa4cd13444", "sighting_of_ref": "indicator--c65ab2e1-67c8-452b-b975-75c259067e28", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf91e5fb-e15f-4461-8de3-b9a3644dcf0e", "sighting_of_ref": "indicator--92215360-1da4-4671-ba41-c79346e2aa32", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebf3c8c9-db90-4901-aa36-c058319e72f2", "sighting_of_ref": "indicator--e65c794a-ae93-41ca-9e94-0f5b720fefc4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21c1df1a-003c-49d9-be81-e3fc7f1b3dc2", "sighting_of_ref": "indicator--45e3e6e5-979b-478b-bb61-b791c66bb972", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81c6a4c3-fe57-46b4-ad9a-b0641d79b3a0", "sighting_of_ref": "indicator--908696a8-f6f0-4aa9-946b-69eb3aabd139", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b54895f-0d7d-4f9f-b726-f84275df3a42", "sighting_of_ref": "indicator--9442910b-7851-4ac5-8069-3ae4cf0a15fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--120c4a60-fbb9-4936-9c8e-c3a31591fc56", "sighting_of_ref": "indicator--e3662ac1-5121-415e-a558-8e893713e045", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--395006f3-e063-4af9-a7c9-1a28f66a4b8b", "sighting_of_ref": "indicator--e3662ac1-5121-415e-a558-8e893713e045", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71971b58-b194-4c3d-b421-02eaf7915029", "sighting_of_ref": "indicator--df135225-ac57-43bf-9927-6ae3a1513378", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9038fbdb-a98f-4c84-a6cf-75c34523658e", "sighting_of_ref": "indicator--4acbeabb-9f4f-41a9-a808-34086a068274", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ec419c5-a47c-4731-bc9b-9b68fed2bf09", "sighting_of_ref": "indicator--6a2b9ab1-bc3a-42d9-953f-8b12048239c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c15bac4e-56bd-4f19-a09e-557b38811f52", "sighting_of_ref": "indicator--13dad937-047c-472e-a1ed-c0a4dff1fac6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89c1560b-1498-40b3-8b06-ec506039a65f", "sighting_of_ref": "indicator--dbb9bd25-916b-4c10-bffa-b212b80ff4eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b253e83-9233-46de-bac0-b949d4dd5d03", "sighting_of_ref": "indicator--e9712be0-3633-495d-96cf-bda5609ab740", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de610a60-4183-491d-ac68-701f1feb8936", "sighting_of_ref": "indicator--6f1db832-f4fd-4153-948a-0e3c456dac10", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a006fe2-2c10-463a-88ea-39f9d81941a7", "sighting_of_ref": "indicator--620f0ecd-d2e9-4ade-afa8-9422fe1ff144", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da389516-718b-42bf-83c8-2b081f43ad49", "sighting_of_ref": "indicator--81d6c1ec-6f33-450a-a8b7-9318de6b8048", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--749e96e5-30fa-40be-85fe-0c8648e13069", "sighting_of_ref": "indicator--999edb17-d7eb-489a-a6c5-f546206f6355", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cb2ecb2-4744-4c64-9a2b-7f866850c462", "sighting_of_ref": "indicator--5a4fde8f-b7e9-4dcd-96fe-97e21a762cc5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e3001de-bcc2-4cf2-96c2-87640640a168", "sighting_of_ref": "indicator--f4794e1e-3944-4c78-80d1-212776a23a89", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61099cdd-10a8-44db-85e1-d6b7599b1769", "sighting_of_ref": "indicator--905672e7-447b-46bb-8724-ef4c82ac9521", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb2818e3-9e0a-4e59-bdc0-14ddc5e527aa", "sighting_of_ref": "indicator--b601c3a6-3261-407f-941b-ba236974f762", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c6d7a3b-74b8-4614-8cf8-1524b45c2cd4", "sighting_of_ref": "indicator--2d128988-75d3-4a00-955b-47113c000e90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--386ab0e2-1a81-46db-9d21-060965a6fea7", "sighting_of_ref": "indicator--93f7e9c0-7831-4b89-8193-ceb03629fa65", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8ae7f03-21f2-46a9-bb65-9ed82f8379be", "sighting_of_ref": "indicator--2f0ecb4f-5712-4d3a-ac70-61a9c7a21859", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8fb1799-0dd2-4853-96b4-637ef63d89b2", "sighting_of_ref": "indicator--a5aa83de-073e-4a89-a1f3-fb7401baabd7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--836672a6-f560-4b44-9575-0d38b5e60e8a", "sighting_of_ref": "indicator--663af8e1-bc6c-4eb4-a2d5-b135c5c76cf0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bd786bc-567d-4ea8-88cb-e65703d48012", "sighting_of_ref": "indicator--ee4cd757-3de9-485c-a8bc-cbb41e62e5bd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e2e8164-1ae6-4c20-aa95-eabe18a89137", "sighting_of_ref": "indicator--ad43fb17-24bf-4369-b795-8bd39307dd9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fb364ea-c828-4300-b1eb-85ba9934e71d", "sighting_of_ref": "indicator--f0961a5b-4ebc-464f-94f0-06b5dc3e6698", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92a3fc13-a0fe-454e-9662-cdb5c8cf827f", "sighting_of_ref": "indicator--10db8fd3-4e56-4ed8-b8f5-f57d5ae517e8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7a7a063-9253-4fed-ac70-643d388f1752", "sighting_of_ref": "indicator--e71af332-ce63-4a51-bf85-37a5201f6b56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64299405-46e6-4753-8314-0ef92edac001", "sighting_of_ref": "indicator--375f69a7-a8ed-41af-b3c2-3715a35167c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a1265de-e3c6-429b-9539-ebca47ab45b3", "sighting_of_ref": "indicator--1ca96402-f27e-4c60-8e9e-013fbb20edb6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f57f92b-0a1b-4158-8d6b-b1fbf385e6a9", "sighting_of_ref": "indicator--b19a99de-908a-4f11-9010-9dd25ec37c2f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--143f462a-c847-40ff-8e6f-83ad73f74dce", "sighting_of_ref": "indicator--a52c9b9b-d92e-438a-bfb6-53dad5f7eae2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--630f84c6-310c-4aad-a2e4-6b5d9e979246", "sighting_of_ref": "indicator--15e92162-9cff-40e3-ab49-2eb7d0c90fe6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f46841f-f00e-4354-a9a3-924431aaef95", "sighting_of_ref": "indicator--e67181b8-4d8f-4949-99a9-71c970c352bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f4106dc-ed32-45b0-9d93-38c5c4772721", "sighting_of_ref": "indicator--a92d298d-f9b3-4a07-b901-c07d0199aa5f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cfcf357-60f0-43bc-9b56-b8f7c77b6baa", "sighting_of_ref": "indicator--6bb1d155-9520-4efa-a6bc-b9aec18d5cf9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d068acc-cc18-45f7-99b0-6fdbe4c1383f", "sighting_of_ref": "indicator--0dc616ff-1e58-4894-8851-ed7249447430", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98ae8a7a-db60-4261-84d7-13214778aaf5", "sighting_of_ref": "indicator--e66ebb35-6a69-4d29-9a84-1b90cfb7670b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--711dada9-681e-4de2-b1e2-a3a2bd61e7e1", "sighting_of_ref": "indicator--c57303bf-4aeb-406f-bb0d-009f0f5e0203", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c96ad57-281d-4913-88fe-f534075e9fae", "sighting_of_ref": "indicator--5c027720-0c19-473a-bfaa-32786bacc21a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05a8beeb-65cd-4fb3-aeee-a42b62e9477b", "sighting_of_ref": "indicator--fd8d98e4-9bce-4404-a0e2-e022aa55a1b0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cede9cd-4429-43d9-90e4-a6e0d84b3952", "sighting_of_ref": "indicator--cda90b27-6475-4bea-a064-c83b383a4770", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--197a0c55-b0e1-48f2-901d-b93238564087", "sighting_of_ref": "indicator--dda9075b-a7e6-4d20-bc4a-fc7f66d217d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e3ddf2f-722a-4cb0-8514-04a11e70da03", "sighting_of_ref": "indicator--91342382-1ccb-4bbd-b007-4ff0c8e3c897", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3bd83d9-b1f2-4743-87a1-af812a3ae3ab", "sighting_of_ref": "indicator--61c07d4c-22e3-4443-9e7c-8ea7188d4ac3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d576b7-f0f7-4106-a333-1e8336f1761f", "sighting_of_ref": "indicator--b4553e94-533e-40da-bbeb-a75d83cf501c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2f28751-ad45-48da-b34a-3d155f6a46cc", "sighting_of_ref": "indicator--6aeb4336-0553-41a5-ae07-e62534a2b4c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84cd7ecd-f4fe-47aa-a78b-dc31002d0f0f", "sighting_of_ref": "indicator--77291333-fc58-4d82-afff-0f2e96e78f62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99656753-ed89-421d-aab1-a1f32eca106f", "sighting_of_ref": "indicator--f05001d9-597a-4b3c-b79e-f130b3238600", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48033c85-7eb1-4920-8702-131070f377a7", "sighting_of_ref": "indicator--3975f879-491c-4756-9c4d-e5a320e375d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9d0a2b0-8051-4554-8551-71089032b96f", "sighting_of_ref": "indicator--49e1964b-ada0-4813-a9e0-7b29d55d3f40", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1fdec64-acf1-47fc-aa8a-c5e9296b1d0e", "sighting_of_ref": "indicator--ec716e90-38d5-4ff2-b9a2-c8ee8f7a4004", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b4468af-623b-4f27-8ad2-74928221f47c", "sighting_of_ref": "indicator--1a5466d5-87f8-45fa-878a-bbe332abd5fb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45d2c0d3-1bb3-4c94-aa06-120dbd197601", "sighting_of_ref": "indicator--587ac5b9-0b3f-47fa-9cc5-23f6d037d760", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb9a0dc-875e-45e7-a8f4-30f3d95ab044", "sighting_of_ref": "indicator--103da721-c308-47e3-95a1-b16e5b4655d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--269fbbf7-2c60-49e9-8bc0-a89a07129ea3", "sighting_of_ref": "indicator--43276ea9-c86b-4348-8e05-9046714c5b23", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a44f4c3e-18d6-4732-8d60-92428442b0f3", "sighting_of_ref": "indicator--e1c757d3-be30-4ce5-9034-a07d577af5de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfae3516-d290-4a20-bcc5-01b667823dea", "sighting_of_ref": "indicator--00893f6f-4f00-493a-be2f-c071121e5602", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9ff71c8-8091-4811-af96-77da20fbbd33", "sighting_of_ref": "indicator--61154202-db27-4fdc-866b-2f93376c245c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78d44ebe-88a5-48d8-8a99-585d9dc79269", "sighting_of_ref": "indicator--16f0cedf-1841-49f6-885e-e01ac18d8d3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bffe1f34-d533-4025-91c6-f59a3dd37e41", "sighting_of_ref": "indicator--1a8e4724-0004-42b1-bde7-5da87653ba7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5548a3c8-164b-4822-95cc-819fabe29d29", "sighting_of_ref": "indicator--d6ac161c-ce48-4219-b40c-7fe70cad9684", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6da36be-e227-41c5-9deb-5e8c00dbb92c", "sighting_of_ref": "indicator--e1fb2020-fc05-4e9d-82e2-ca05b06a89e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e3099cd-4a4c-4cf3-9be5-ef6522b57b8d", "sighting_of_ref": "indicator--47dd33e6-3d47-4070-8d7f-4174f93c3275", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a79b33ba-6c70-4315-a8b7-e47400a72970", "sighting_of_ref": "indicator--1d83ca47-1e2a-4bdd-8d38-c3996ddbb0c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e05cec3-b78d-47e1-8dcf-8a72c240062a", "sighting_of_ref": "indicator--040c33dc-6322-4915-9085-fe4054608845", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d07e98-bd56-47e4-ac77-f81768238468", "sighting_of_ref": "indicator--ed5ed39a-6c8d-4830-9b2a-1b60f563bfc8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4df670c0-5384-46cd-bbb5-798da8d367c2", "sighting_of_ref": "indicator--e082af11-6777-4404-bb78-2468d0597034", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efdaedd6-691d-492c-b64f-704226816f6b", "sighting_of_ref": "indicator--5e70fb50-3348-4862-9221-627d00d497b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30c1bb62-b744-4882-a1f8-c04fd2f9de77", "sighting_of_ref": "indicator--3cb10c03-40b5-4297-9199-fe921841cdc2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebdb1741-57ea-4bf4-b218-92ab6d32b7d0", "sighting_of_ref": "indicator--ab62908e-75a7-437d-a702-0c7528a88f79", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07c28b0d-bfe1-4d18-8a1d-63219f445377", "sighting_of_ref": "indicator--8d058044-7ee5-4025-8e42-fd8d11825859", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--641f7a78-b018-476a-8473-88f9ee6d3b57", "sighting_of_ref": "indicator--7507df36-953d-4517-b8be-2173bad5335f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e1d483a-c2d5-49cd-b7a3-16f424da7cdc", "sighting_of_ref": "indicator--03079ca2-dce3-421f-bc2b-bee00e937e25", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74fc4105-72ff-4918-9a44-06f968d47158", "sighting_of_ref": "indicator--69f57dc8-5526-43b5-8629-ec55671bb4fb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79551323-2bcb-4838-bab6-c48da67eafdf", "sighting_of_ref": "indicator--1c49de0c-c6bd-454e-8b14-2dbe1f02c0b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f89707e9-502c-412b-98d9-c04abc2cacc9", "sighting_of_ref": "indicator--d305282e-d3da-4df3-9f05-76849ff654dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7309c983-06e9-419c-97cb-b066ca299944", "sighting_of_ref": "indicator--e7602242-9305-4694-9db8-5f41ed42d6ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bed149e-9b11-4044-8941-c217857a5174", "sighting_of_ref": "indicator--e1e05cbf-31e5-4128-98ca-3f77ebb33b2c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bea8c5c-3708-4de6-b92e-884aefa7e6f8", "sighting_of_ref": "indicator--8d97c5df-ac70-4329-bd57-d43f62435b30", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccdefe18-72b8-4f86-be96-3c82241a21e2", "sighting_of_ref": "indicator--056a4d54-487e-4bcf-a7f8-cc4c8f62a4c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec07d49b-ce9c-4470-af90-2439383d3945", "sighting_of_ref": "indicator--76c78a86-078d-4bf4-b513-b8a17f644991", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6dc650a-9c91-4dfb-a84b-4bcff915c0a4", "sighting_of_ref": "indicator--4342a1f9-1eb0-454a-9444-a54ab025819a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecb78904-1442-4799-abb8-452ec8b5252f", "sighting_of_ref": "indicator--866a18eb-2a73-42cf-bf96-2a794b76ffd5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdb896e1-9ee9-43a4-8791-d87f0cd9f00f", "sighting_of_ref": "indicator--f4eb509b-0223-483f-9ca2-f43b5affccf0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec641c94-9374-479a-a271-92c7a6fa6f30", "sighting_of_ref": "indicator--e67cfc48-6fca-4cca-a96b-86a8b3e2fafe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2166967-d0dd-42cb-8c3a-e285b3c80874", "sighting_of_ref": "indicator--10977fc3-2747-4f6a-836e-c3e004c2dac1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80d1f879-4242-4f65-876d-e933bc143249", "sighting_of_ref": "indicator--06b07a55-d3d2-4058-b53a-f36a12fac6ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fb83b69-3f8d-48f1-b45a-aea50e31cbaf", "sighting_of_ref": "indicator--dd61784c-92d7-42fa-86d5-1910c8b75d0a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cf40246-1d6c-4e92-b120-74710a290876", "sighting_of_ref": "indicator--909f6f53-99bf-43f6-98be-016c476a3eee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e1a05c7-1867-4d68-bdd1-5727d5a5d2c8", "sighting_of_ref": "indicator--01657ed2-6cf6-4c68-aa98-738a32d5cb6a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be09ac12-437a-47d3-894b-f7a8b0e62870", "sighting_of_ref": "indicator--77c783bd-e81f-4dde-ab3e-2e9a7a9491bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a9f7835-90b2-45a3-958b-1f697e7bcb7c", "sighting_of_ref": "indicator--9903222d-952f-4470-84e7-4dfebaa87ec4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c20cc7fd-f08a-49a8-a9db-1e79ab964907", "sighting_of_ref": "indicator--5998a6c6-2fbb-4f29-ae38-eb0acfc26313", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b53c3cc5-ced6-4542-a63e-d2441266b213", "sighting_of_ref": "indicator--bdc0a510-d413-49ce-a704-42aea6b00f46", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d810a214-a5cd-4a00-8fb1-5cfbd7369d4c", "sighting_of_ref": "indicator--126aaff3-97d6-4d2e-ac15-7a8dc8c8893c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91236e61-6600-4711-813c-b454287c74f1", "sighting_of_ref": "indicator--a7cb68a4-58e8-48f5-8dd8-bffe9b3ab7c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9708b6b4-b6b9-479a-8ad1-3bd4bb16a1fb", "sighting_of_ref": "indicator--c29a2a78-f4bb-4909-bba0-d047ce58121f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83417260-3a45-4b68-813b-401495c7a54f", "sighting_of_ref": "indicator--b3628a8c-8be6-48b7-915b-f544db8a430a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cd5f272-a79e-47c4-8e5b-8c72ea39d712", "sighting_of_ref": "indicator--7767c590-2a0b-400c-93f9-d3bb975a2760", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fad81f5-2187-4106-b266-91420939c81b", "sighting_of_ref": "indicator--2829c507-f8ea-44af-8e05-7f7bc2297a08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bbc3167-ceb8-45db-a42f-2f0da6e2383d", "sighting_of_ref": "indicator--393dbbaf-3fdc-4527-84ed-8cf4b0e55cf9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31db4111-640d-4f76-8526-f5de02ef3427", "sighting_of_ref": "indicator--a8ed3ad2-cdd2-4f34-b39d-460d9a400b33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcccdfdf-5420-44be-84a4-d438564bcb88", "sighting_of_ref": "indicator--8990d8b9-fd01-430e-8bbc-340363a18d3c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f370d75-0114-4eb2-9b54-077348a138da", "sighting_of_ref": "indicator--8b17a679-1641-40f9-b7dd-401a274fdd3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eba00c40-f9ee-4443-b5d3-1cb11cf0d7b9", "sighting_of_ref": "indicator--2384ae1f-1686-44be-8c48-aa2bfd01e58e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ccf2d45-fa8e-4869-8bcb-82407b7cf381", "sighting_of_ref": "indicator--304db170-e13e-416b-aeda-a3b277de642a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--339ad97b-7802-476a-8166-e4066a6f7a83", "sighting_of_ref": "indicator--df5b5d84-95b3-4514-8d49-038f9e8b9920", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4a2223f-4cf0-4479-a7bc-759700b333a0", "sighting_of_ref": "indicator--815c10b7-a83a-4f47-b192-fe7026a0763c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd8a77c8-51dd-46d4-92fc-97cccc227912", "sighting_of_ref": "indicator--5be369af-fe8b-4b89-9454-45eba73ed26f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4b51d4c-622d-4f6e-b674-8f33d055e51d", "sighting_of_ref": "indicator--97809a8a-7649-4bb7-80d0-9c75d537cfd1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87e5432c-ecd8-4965-825c-e87f75121510", "sighting_of_ref": "indicator--8e3c7433-9ffc-4be5-92d2-27ed35e989af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac9e259-08bc-46d2-bc3f-599263aa341a", "sighting_of_ref": "indicator--74497332-0a2c-49e0-a8f7-43ee9da4ca81", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2325f11-4e39-4acb-8100-1d0841383da5", "sighting_of_ref": "indicator--4c7a3ddf-6337-446c-bde4-3aee90b6ace2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--500b1c28-5bbd-4172-b6c7-be6cb8952136", "sighting_of_ref": "indicator--c21cb483-d1d6-4123-bfc8-65d7307864cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25684212-9765-43a4-90d9-e46d1a8a516b", "sighting_of_ref": "indicator--91ea8d3a-1847-4be7-8393-882e1b0b82d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3e336b6-ccc7-4eaa-9fb0-a54f77fe2bbb", "sighting_of_ref": "indicator--0d15da4f-fad5-4e74-b223-253d50ce3ffb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58bdd3aa-754e-49c2-9385-10b3096a53ec", "sighting_of_ref": "indicator--41b8d99a-881f-489e-8d37-5116356314bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb5f8906-6569-4975-bd77-d4a1093e31cb", "sighting_of_ref": "indicator--636128d8-1d53-40ae-8ae8-0ac1af75e6df", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a08c1cd-17c4-49ab-a8b6-7469531da697", "sighting_of_ref": "indicator--dc8c968e-b7fe-429a-91cb-77c451811425", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1b05704-ea90-487d-9bd8-35d7fc7d7551", "sighting_of_ref": "indicator--31165e53-1009-488c-95bc-e25dc9e7d4b0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48039048-c663-4034-80ab-fb3d437abe62", "sighting_of_ref": "indicator--2bd6ecbe-4a09-42ef-b736-5aef8cdfe8a7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6251689-9242-46ed-896e-99b4d46a8698", "sighting_of_ref": "indicator--a4f84673-36b0-4e6f-b7d4-cec0b990eec2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--592f4081-a7e9-4dee-9798-1c6385ed572d", "sighting_of_ref": "indicator--ce1fdd8e-86fa-4603-beab-74b9a0ed0bcb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--246b970f-4a39-456f-8e78-7be72e8708d6", "sighting_of_ref": "indicator--799fe822-b7d2-495e-87ae-60f86ce944fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39e18594-b0a9-49ee-bc7e-91c7d996d5a2", "sighting_of_ref": "indicator--2ee51661-fe12-40fd-ade9-0191c38723d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a61f13a-982b-45a6-9b76-3034d66bf256", "sighting_of_ref": "indicator--24f73ec7-188a-4e2b-bae6-e2eeb4234caf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a3c7a66-abf6-464d-827e-4ee094e3a12c", "sighting_of_ref": "indicator--e35f2aae-f167-4f95-9276-ebb7f1f01ba3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dfa2d11-2a93-47bb-90aa-a010d7e15a82", "sighting_of_ref": "indicator--25c8557b-bb16-4ff3-a78d-3ee2db5b5d4f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0b73df8-8810-4965-80a5-48f483fd7df7", "sighting_of_ref": "indicator--9d43a275-53a4-488a-a9a3-352467b475ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cff1e69-ad22-4870-ac4c-377069cce759", "sighting_of_ref": "indicator--9ac6df8a-51f4-4db2-8d37-923fd3fac5f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--145f68d4-e9fa-4c0c-a580-687f9aa229f0", "sighting_of_ref": "indicator--57d75757-233f-45d3-8e39-149388986bb6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf6d76b6-14b4-457b-b3c8-ff1cca1d0fd7", "sighting_of_ref": "indicator--dac31d16-1d04-4f83-abec-56245921b9dd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ca74445-634c-470b-ad16-4fcbdc2b6e47", "sighting_of_ref": "indicator--0b209939-0fd6-4c3d-ab38-a0ec475f8882", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c0d31ba-35e6-46ee-8a63-42b228148246", "sighting_of_ref": "indicator--ab520c45-8ceb-4011-8034-8c8e1f5d8c2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c528abe-05ba-4b07-b47f-f4216771bff8", "sighting_of_ref": "indicator--c4439337-3976-4217-b156-1d406bb67be8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb90694-b6e0-4ac2-937f-2ef102c1c947", "sighting_of_ref": "indicator--847bb2df-b256-4527-a6ce-f2dfa0c30f83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3daf87fd-6fe3-4a71-9436-98ea3eccf52c", "sighting_of_ref": "indicator--7f6dde38-23dc-4a17-b6d8-4dc87e003ed9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3188e8ac-e5a9-4be9-a8a1-c2f002dcac2c", "sighting_of_ref": "indicator--3d053e75-8360-4919-b951-edb670cd196e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faadcddd-b22e-4c8e-b7da-d92fc6d0ab00", "sighting_of_ref": "indicator--be6860b3-ed1a-4d03-b047-a70428d04ff0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0671b48e-e0c9-4fdc-8a54-32802eb5fbd6", "sighting_of_ref": "indicator--062507bc-1ace-4e48-96a3-005c4e3cc3ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1f1570d-0a46-45ab-950f-fc9e56cf96e0", "sighting_of_ref": "indicator--182d9ee6-cdfd-4b30-9376-40a2ec3b272a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee0ad7af-5602-4ba9-9f8b-92b585ab4e4a", "sighting_of_ref": "indicator--41f28da6-45e1-4578-85f0-b81440e61181", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d19d8532-8868-4797-a46b-a9b16278c238", "sighting_of_ref": "indicator--a0ce1592-3e41-42bf-b6f1-1cc61eba3eeb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--598a6ecc-2998-4c6d-b272-47404e3cb6aa", "sighting_of_ref": "indicator--dd279cba-de57-4994-b570-7c55561b1f89", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74052a7b-f671-4a7c-bcbc-ae8a26918fe7", "sighting_of_ref": "indicator--099acf1e-b775-43aa-9e31-75c79daa27aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21a4c014-a4c2-4d94-9715-c534e0d79169", "sighting_of_ref": "indicator--1509d33e-ec50-401d-aa75-0b73b7cc4ef0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e37561b-0c7b-456f-ac90-5f5423c075e0", "sighting_of_ref": "indicator--ae18143a-634c-4f08-ac10-7c7d701870ec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd214206-0feb-47cf-a424-b63702fcc065", "sighting_of_ref": "indicator--64fc23d3-6217-4778-9e93-b6191e74e7c8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f09e649b-40cd-41f8-87f8-3b845ccc3527", "sighting_of_ref": "indicator--606fb8ad-31d6-4eea-b223-d4c927b5c0f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51c828a8-627b-427e-87fc-8980c9493cb7", "sighting_of_ref": "indicator--ffbfede9-dfe7-4d4f-9816-a2463bf35d17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fd15426-d33a-4b03-a591-7a77594fd0f8", "sighting_of_ref": "indicator--ddc06da4-be5b-45d9-abc5-cbf410bcff46", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7fa12c6-55d8-4d05-bb5f-4f8a5720bb75", "sighting_of_ref": "indicator--661eab8d-e5ed-4b11-8ee0-ef115ae3b755", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fc84100-58f2-4d9b-b7bc-7cfa9545a893", "sighting_of_ref": "indicator--cf1788b0-e8bb-492c-aca8-370b661db8b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea05f1b-7123-4596-84e7-e9877c83a3ab", "sighting_of_ref": "indicator--ee755db0-93e1-47c1-9403-08085fcf4e18", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f60ad9e5-e8d5-4ba5-9b95-91f663e34fbe", "sighting_of_ref": "indicator--fd9e7afd-1edd-4cb1-bebe-b79fa6dc2d37", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3dfca26-979d-4cc6-8f43-f0ffde20c28f", "sighting_of_ref": "indicator--6a50d900-2d94-4c9f-847f-8213bc61b01a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b33e2558-95fe-4609-b043-42cc939c2a4c", "sighting_of_ref": "indicator--c5abb1ee-8051-42c8-9504-4d7231298dfd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2703d902-8243-4e75-b097-3bee533da6ab", "sighting_of_ref": "indicator--31ac7ecb-fca8-4fec-a068-dfe66a8a6bda", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82eb4233-b032-4649-a2e3-003ca111571a", "sighting_of_ref": "indicator--b17ede0a-6cfe-41f1-a619-62a85c286456", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89552be1-9be3-4b12-bb7b-5fcd1f555bdb", "sighting_of_ref": "indicator--6b319979-3e4f-4dfb-939d-527b93d021c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b4b07f9-b80a-484a-9b60-d3b9a3141bb1", "sighting_of_ref": "indicator--9328c104-05d6-48ea-b47d-bd0f06fb1dfd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b56dfc3-0e71-43c3-b8b4-ffbb4b3c1b5c", "sighting_of_ref": "indicator--a1ed58e1-ca13-46a5-89c0-9f99e3ce2fb0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fab507fe-989b-4512-b2dc-543c4e00a11b", "sighting_of_ref": "indicator--2f490fa0-8c2d-40bd-874f-b636abb79b00", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--516a0555-82f3-4c29-aaeb-8dfe6cf1d26d", "sighting_of_ref": "indicator--89a66b2f-9f33-406e-b9bc-0c53463d4cc7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb79db16-ed6e-41ff-8721-0aaa1019a514", "sighting_of_ref": "indicator--c0c8411b-c4fb-4858-bf8d-5631e35c6e03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f7ffa1a-710c-4dde-a5e3-922c3cbd28ff", "sighting_of_ref": "indicator--f2da10ec-5a01-41ef-b6d1-f594d5900dad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89565566-4e90-4e0e-848a-e2ec36209d4e", "sighting_of_ref": "indicator--8220c712-90d0-4e17-bccb-7b09db55e795", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a97ad50-71c0-4176-9ad9-8d5af6962bbd", "sighting_of_ref": "indicator--6b864809-c96d-4ad5-a76a-2da38ec893c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7e931f6-97d5-4951-ae09-737ccf1d14b4", "sighting_of_ref": "indicator--22f89fda-1348-479f-9e8c-7ce770b727e0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb4f06a2-3ee5-4d78-9c36-8a60e44e63d9", "sighting_of_ref": "indicator--904d95f1-9d5b-4f25-aaa5-8eeefae7f7f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14e0563a-e459-4de5-b1c4-0a6fece213af", "sighting_of_ref": "indicator--41bc485b-6584-401a-88dc-5ab2039c80da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9fe6928-3ce8-4786-b83a-e7f54bb794db", "sighting_of_ref": "indicator--10a97918-9848-4b67-997f-a4ecca265010", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8c0dac6-bf80-4635-b36e-9e906859626a", "sighting_of_ref": "indicator--53e6ab4f-4786-447c-aef9-1e248a821a27", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59dc5edf-d45a-4e0f-a248-132e4f9ec7bc", "sighting_of_ref": "indicator--223b35a6-997e-4d3c-850b-a777f5d73c16", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b934a1eb-0566-420a-ac33-35bce8e59092", "sighting_of_ref": "indicator--debc0d65-85e9-4541-9c0f-dc5e1d209d9c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f65895d-caef-4fcb-80b0-da1417f886c5", "sighting_of_ref": "indicator--82903e31-2185-46c6-94a7-d56fa10fae57", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--642091d0-8c87-4a49-9574-a9672538c9af", "sighting_of_ref": "indicator--3b3d61f1-6ad5-407c-95ce-9bf576447296", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f3ad598-6793-4d3b-b22e-a02ce146f4ae", "sighting_of_ref": "indicator--83765e87-9e22-4572-9dfd-238178f30c5d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94af81d4-cc68-4fbb-bb27-52e112377811", "sighting_of_ref": "indicator--cfe1c857-3671-4983-9f02-30de2f112bb3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2a48616-5f36-4a79-8e48-7f537175a2f1", "sighting_of_ref": "indicator--bd037e31-ce15-42e7-81d5-bf994a46a2d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28fcb2ad-cf12-4636-a5a1-17f4a82f4a23", "sighting_of_ref": "indicator--955a8eb1-3861-4c1d-88c1-69a3c10e9ff4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa4715ea-be50-40c4-92df-298b32e21639", "sighting_of_ref": "indicator--3f9d5936-c53a-4025-a609-35eae03243ec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c93fa64-2c79-410b-94de-9ec6b3e0c7d9", "sighting_of_ref": "indicator--7bd8244c-0906-4159-9cc9-9c24e8dade46", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b204cdd-7aa0-4366-a04f-e4d11975cecc", "sighting_of_ref": "indicator--fc27cdc1-c498-4d13-a63d-293456f53c0a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03116f09-2c16-4a84-9b56-e45bcfa3b989", "sighting_of_ref": "indicator--de6cb6a6-8a3c-4fdb-8bb9-0e7ab17a9127", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a436d8ed-2cf8-4a0c-8921-9753efc56ad3", "sighting_of_ref": "indicator--4fe88b9d-0ad3-4717-8575-f8ead8613dc9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab43df8b-4fa9-44d7-96ae-b1832f6a6247", "sighting_of_ref": "indicator--f1c64a3d-cdf9-4fb6-bfad-de1c979638eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ee6e18a-34f4-4a68-8496-c3f33cf60965", "sighting_of_ref": "indicator--c4a12245-9252-4ef4-bcfd-01dfc10eca01", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6efe79bc-68b4-4b90-9c9e-972c4a37b336", "sighting_of_ref": "indicator--65d39d2b-b17a-4476-acef-701685e5eba6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a06240a3-38ae-4be8-a830-478deb7fff9d", "sighting_of_ref": "indicator--b6b0fedb-f69d-4b97-acdf-f0ffc04f2a24", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a375d22e-c892-4cb7-b3a9-25b6d8c01cea", "sighting_of_ref": "indicator--2c0ad9d3-b1f7-4003-bbe9-702229cd9bf5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e176545d-6ba6-4b67-ad7a-c97bf7c11b8c", "sighting_of_ref": "indicator--efb905f4-4a39-473c-9c58-e2c4a83a1556", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43dce983-2765-4b73-8bea-4f583ba3c7a0", "sighting_of_ref": "indicator--7dfc8630-746b-47b6-8f6a-8020d25bea78", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9d4faa2-04f6-482e-a746-c83e3ea0626e", "sighting_of_ref": "indicator--b1624701-6d01-4cd8-8d10-1f29fea5e3ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5172f963-d8d9-48a8-bebc-a400b08b7982", "sighting_of_ref": "indicator--18d7c7b0-5ea2-4781-8107-646f030d94f2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18bdcedd-df03-42ec-878e-28ebe9df627f", "sighting_of_ref": "indicator--db84952c-beed-4450-b065-995c0dd3efa2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--442718ef-7e8d-47a6-a3be-ce1bfbe5f689", "sighting_of_ref": "indicator--46e5135a-c1a3-4984-b173-45e787e93729", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b8b7ca2-9d0c-4325-a18a-b4896d5b1667", "sighting_of_ref": "indicator--2b82a4cf-7e3e-42fb-b3c6-f73d86323cd7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4d54935-d53a-441e-a1aa-ad6f6bed0d38", "sighting_of_ref": "indicator--84480073-e4b6-422c-b5cd-2c06e3f65a65", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c7f0609-9fac-4b2f-86f6-6c1deb2ee43c", "sighting_of_ref": "indicator--179cb8e3-3e54-40cf-b0d8-a9a8f86e1b55", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5f05f5-9613-42a8-9cc6-9b7551ad0c5e", "sighting_of_ref": "indicator--4ef0b2fc-f579-4fc4-9490-3b035d9bc693", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de54a7e-0701-427b-9760-952ac79ef3a8", "sighting_of_ref": "indicator--e8c95538-c100-4440-a1ab-5ed94dfc89ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cd0d736-7bf2-4a77-8ff2-d167c21176ad", "sighting_of_ref": "indicator--69a5b9ba-5d28-4928-9e6f-003aea8cf879", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eed7fc7-df50-4f3d-8acc-ff3606d11cd1", "sighting_of_ref": "indicator--711e8bca-52ed-48ed-80ce-033bc0c8c30a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5569e75d-a5ac-4154-ae58-618e3dab86fa", "sighting_of_ref": "indicator--cde36fa2-3770-4ea3-9d15-4492d298b655", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1edf3239-3bbf-4c3e-a9c1-cf8364ae1c0b", "sighting_of_ref": "indicator--dc858485-7e6f-46b3-b70a-b3b45280b812", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76fda429-d6c9-4f17-82db-6f9483460a4d", "sighting_of_ref": "indicator--1debc22a-1858-45f0-b5d8-f833b7c84e33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--935f8829-cced-4c28-b289-18c66c4da531", "sighting_of_ref": "indicator--b9648f6d-8076-44fc-901b-4aad029d20d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6df93d45-f0d0-49cc-acfa-06404e15ff31", "sighting_of_ref": "indicator--c1f55893-6ef3-49c9-9d5d-fddcb137b6f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c747bb02-f4b7-4836-8379-b270d5fe5646", "sighting_of_ref": "indicator--f874e69a-96a7-4e5a-bd94-9c34e6e4fe04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fe13cde-f848-4a7f-b68b-3b5321622e57", "sighting_of_ref": "indicator--9c891243-1843-49c7-9adf-96072479f22c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b239b8d-c854-425e-bf51-14920f3f5bd9", "sighting_of_ref": "indicator--07644eb0-0589-4e88-b871-b35ce7b95439", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a02bf14e-9aad-4fac-9997-21d7682faa3b", "sighting_of_ref": "indicator--0614bccf-24ee-4339-93c1-4ef2324b19c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e958925-7ba3-46c0-917b-b018fc465d92", "sighting_of_ref": "indicator--82f2b806-7578-4163-97fb-475b66f4b770", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8361d4f-41a2-4068-a864-c2f615f88982", "sighting_of_ref": "indicator--1765ce23-cd57-4a56-bc6e-033253fe79b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6847fa02-724c-4569-81b8-f57fbd416d51", "sighting_of_ref": "indicator--48364318-b476-4315-9f59-0e288d32a4b3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc5c7497-ba23-40b1-818f-801141e43fbb", "sighting_of_ref": "indicator--1e7b58e4-2566-4234-b5db-206406e5d556", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f2c6864-ba76-4f6e-973d-b465eccbbc11", "sighting_of_ref": "indicator--45578eec-60f3-425f-86d5-d9b3d67d8521", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d7b6c39-8272-449e-8046-c3465be3b234", "sighting_of_ref": "indicator--5ba5f2c2-06ae-4b05-bbf2-6479186ab843", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58ec9b83-6a78-40b6-bf09-67fb6364bb35", "sighting_of_ref": "indicator--e1d7146d-adeb-4bba-88f9-78546eba5695", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a90f448b-9e49-41cb-a45c-61e41bc1f189", "sighting_of_ref": "indicator--b88a1536-455b-4a45-a2c3-17a1d28bdf0d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83cdd6ae-a246-4a46-812b-5fa680b3ac3d", "sighting_of_ref": "indicator--a9d5ebbf-6609-40ab-a56c-96d5489fd9e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbc5c595-9f9a-4b6e-be55-2ab7db1d9684", "sighting_of_ref": "indicator--a8002ed4-6e81-4a86-8740-7597d4d67ca2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f6ae58-264e-4cd0-9a85-9268d8a2c009", "sighting_of_ref": "indicator--312a31b5-8998-44e4-b5ad-5488e0933b5a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3380c8a-1e16-44d2-bfd3-9b28e69a3493", "sighting_of_ref": "indicator--0a6f89cf-e39b-4e72-94ea-baa4f7d7f563", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2219b190-de5f-4ae8-923c-d85b56ff5497", "sighting_of_ref": "indicator--ac33089c-6a25-41ab-92c9-a564bb5a9d6a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d16600e-6eaf-4f9c-91a2-c50798dcd487", "sighting_of_ref": "indicator--3d40d247-970e-468f-ac19-b7f56c9f9b6c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3db7aa0c-c06a-4363-b9a8-32c32efddf9c", "sighting_of_ref": "indicator--706d663b-57f6-433e-b5f9-0d44ee8af4d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb3e238-5cb9-43c9-a2c8-e7d9f15eac7f", "sighting_of_ref": "indicator--1ed5b24d-8138-45fa-b6a4-847fc7523184", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddbd0893-f513-4f28-94e9-faf14c68c6f4", "sighting_of_ref": "indicator--e6cd1acd-2ad4-445d-8cd8-ea20ab50da1e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--530e9ce7-834d-4025-9bc3-3ca917af603e", "sighting_of_ref": "indicator--43ef79c6-7aa9-46aa-b0f8-d76e0a30cdca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--911ed3a1-20aa-4c76-8a00-862e075460c3", "sighting_of_ref": "indicator--0b8cbf90-d25d-41b1-bfc0-868510d2abbf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9391b56e-7b5d-4513-9103-e8ba413421da", "sighting_of_ref": "indicator--6c556abb-6073-4f05-beff-b77c45425aa2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78fdfe38-afa7-4ca9-b693-ed7a9babb928", "sighting_of_ref": "indicator--bed0672f-e4b8-40f0-bf58-8f836d25ab89", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd1f8279-5c6e-479e-8395-058f464f5287", "sighting_of_ref": "indicator--48deb943-35b2-485e-83c8-04b687b78d9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de6e8e6c-78b7-4488-88f7-758ea385f3f6", "sighting_of_ref": "indicator--f27f88d6-dc34-4cd5-96ab-fc595c16c713", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--792d2a1d-2baa-49ca-8764-45676a7803dc", "sighting_of_ref": "indicator--f8899754-69fc-48aa-aa21-48b8c537795a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c001c4a8-157e-4f7c-a6d8-b814d304b630", "sighting_of_ref": "indicator--bd4ae03e-83bd-49e0-a833-93adc3808ff5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d98ab44-a949-4e8a-ad67-598cd58fbfca", "sighting_of_ref": "indicator--680cad84-1d1b-4bd9-893d-51fdabb3b5d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a12fde54-671c-4f00-b228-c3299488c6eb", "sighting_of_ref": "indicator--3c36e657-739e-48af-a716-5871b0e35446", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ff90acb-edee-4285-b98d-4816509d35da", "sighting_of_ref": "indicator--4ab3163a-3801-4310-9e39-e03a438a57eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--575aa4aa-f858-413f-a41c-1c54d699fbfa", "sighting_of_ref": "indicator--204cb8f4-2723-4a09-ae4e-ccfa420365e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49e806e3-7e36-406d-a3e8-4c6020a002b6", "sighting_of_ref": "indicator--043ed3b3-67bb-4370-8b3d-44c6569e643a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b422a830-96b0-4aa1-98b5-8c32a75f77fc", "sighting_of_ref": "indicator--d33952d3-3940-4b24-bb05-f52a8a4cfe9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70319eaf-ff2a-473e-a59a-f38ec6697e3d", "sighting_of_ref": "indicator--643fcf2c-00f2-4eda-92e9-5a107d67e1d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dff484a3-ba25-43c8-a5c0-e006a99db604", "sighting_of_ref": "indicator--0fd94ba3-7fbd-4366-8c6a-0333e0db5c7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f862f1c2-da4b-40e5-a1fb-12c30baea25a", "sighting_of_ref": "indicator--5518b1a9-1a38-4a70-8fcd-5d8c4a09de62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76a5d0f-3e4c-4082-9f95-dc9c12d0737a", "sighting_of_ref": "indicator--89dd6114-ebc1-48b7-818e-151ca92739a6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--111746dc-13b8-45d0-95c7-b59a64c97164", "sighting_of_ref": "indicator--a666bf41-7c7c-407e-889b-c9cf144d0340", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44b67478-24ba-4cca-8e72-f53bda6d03f0", "sighting_of_ref": "indicator--7b89bcdb-181b-4e3a-a754-3c4f87f231fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6cda275-5a56-4202-abc1-b0061fc216df", "sighting_of_ref": "indicator--1d479bd9-6d57-479e-985e-b331d433c6e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bef25f15-2d1a-4c23-8300-66df0b09c03a", "sighting_of_ref": "indicator--ce4ffb07-e9a1-4523-a66f-c741e11d5f12", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--821eebba-611f-48a3-a1ed-b3f6cf5f0444", "sighting_of_ref": "indicator--962c05ae-0e40-40ad-85a9-698911138ab8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--936688b6-ed33-46ad-9dd5-4bdc5347811e", "sighting_of_ref": "indicator--a7545006-ecef-4b4d-bfdf-a28dcee9d221", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6ac0fe1-beb0-4280-a918-5a7843c6e916", "sighting_of_ref": "indicator--140374d9-33fb-4c5e-bd25-a7092a07d5e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--084cebcc-f9d4-439f-8efa-0a3168c9be69", "sighting_of_ref": "indicator--685c0c8c-e261-42bd-b6b1-418b21fff88f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46f35566-aec4-4a45-9c83-a16eed775eb0", "sighting_of_ref": "indicator--978bcece-2b7f-4d99-bce9-87b9c67a0250", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dd22b50-d3e4-4094-8b3e-0bde704013e2", "sighting_of_ref": "indicator--c067ac97-3cb7-4905-ab35-c828ef6f6296", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--308c8896-61a3-439e-af95-c1e5b9a00ab3", "sighting_of_ref": "indicator--394c2aca-c333-40fb-b410-3d5fc72ec592", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fa7fe68-5b68-494c-8953-0e406cd932b9", "sighting_of_ref": "indicator--11bc51a8-4966-4820-82fd-94f044463492", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11371c6d-60ef-4da8-903f-a08d6f7ce03a", "sighting_of_ref": "indicator--81ae6ec6-b544-4759-88cc-de061302ded5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--401dff76-184d-419e-a991-4d903032457c", "sighting_of_ref": "indicator--40a32556-5cb4-4bda-8b0f-55592b02fdf5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfecd10a-8615-43df-9cce-7e113ed6a8bb", "sighting_of_ref": "indicator--0ee8aa4f-693d-45cb-90e6-5d0f8bcd86bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93654063-624e-4655-ad5c-05b0407fdb63", "sighting_of_ref": "indicator--a74fef4f-583a-4e6e-9aab-6c76c9250d63", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f11e7f63-879e-422b-a7dd-e8311e186273", "sighting_of_ref": "indicator--8db37f79-8ffc-4038-8a9b-bb5884e7e7f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6cebcc3-666e-45ea-8d2b-4b82e6e41089", "sighting_of_ref": "indicator--6fca82fb-19e6-4eac-bd2a-09e8b76493d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a0b6403-4a74-4725-8459-f44e20fcde6a", "sighting_of_ref": "indicator--dc6651ee-bccc-4e08-b669-fd645cc2ae75", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50b67043-edc2-4c0a-adee-5f5116ef5523", "sighting_of_ref": "indicator--2c265e18-afe0-4f62-834a-022ad3e4bca6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5dc4fa5-8085-4e23-8d53-3fd43b9a1ca7", "sighting_of_ref": "indicator--dbac080d-e786-4876-9877-254cd133d965", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--966c6b5b-2031-4368-802e-c36e946e43c9", "sighting_of_ref": "indicator--04f54752-4ba7-4dab-8ced-0fdcbb4f0e60", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00d7ebe5-0c8f-46ed-8499-4c2142bc127b", "sighting_of_ref": "indicator--f54e851e-76e7-49ce-80cb-237a41269526", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e99be95-8f16-431a-8298-eeeb22e22b2c", "sighting_of_ref": "indicator--5dc0ae94-0b39-4757-aa35-80c22c15f40e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6510409-ac30-4779-898d-68caa218454f", "sighting_of_ref": "indicator--33fdb5a2-13be-48cb-85a2-4ffa6d6a49ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fefc15c-ce29-4e33-838a-e541202cec37", "sighting_of_ref": "indicator--6fc6dfa6-ba82-46ef-8ff6-3c8ef84b2d7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e87b49c9-7cb3-42f1-bcc3-3c76a1a53c43", "sighting_of_ref": "indicator--9ab07142-4883-4e54-a385-564e2764d6b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3874c9c5-e17e-456e-97c0-b597a99ce268", "sighting_of_ref": "indicator--6af22fd2-eb9a-46a1-b54e-b6c9057827ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--799ba2cf-2a6f-4511-833d-844a39239627", "sighting_of_ref": "indicator--155eaa87-ff39-4ad9-ae53-50ade3615fa8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e01b6960-aa18-4a60-890d-8a7b9d182771", "sighting_of_ref": "indicator--ffe5146a-db27-4964-b902-c01136f1c32b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e60aa71b-4008-4220-bf09-10a367715afa", "sighting_of_ref": "indicator--4f24c668-dacc-4a94-977a-c7bd146c705d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3874b000-4253-4ef8-bfac-20a255f2888b", "sighting_of_ref": "indicator--faa2e240-5cda-4cb0-a1dd-76d426245703", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8f6d152-4c3b-4d5a-8004-80f803cd7072", "sighting_of_ref": "indicator--00bf6d5a-3fac-490d-affe-392d48ae604a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c72ccec0-e12d-4520-a42b-73a38da53698", "sighting_of_ref": "indicator--194e1896-b7cd-457c-8b3d-db8533fa67d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f45edbd5-1706-4c7f-86b2-8038f73ada48", "sighting_of_ref": "indicator--f910db9b-a2e6-4b17-84e3-bfc5097527f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dd8a176-8cc8-4d63-a7c0-135028562c43", "sighting_of_ref": "indicator--91c0d789-2dfd-4f3d-8992-7515ca218f4e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be78b84e-55b4-4274-b243-ff6a833193d0", "sighting_of_ref": "indicator--a05b81d9-07e1-4531-aa64-fdf0231cc739", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcffcb60-0e67-4082-8092-b3966c1174fe", "sighting_of_ref": "indicator--4ce3562b-a8cc-49cb-969e-843f93489314", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a9f057d-0aeb-4882-8471-73cd82027939", "sighting_of_ref": "indicator--433cad5d-5332-4ba7-adda-e68e51a48406", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76849b6e-0306-418b-9be6-3fda5df044ed", "sighting_of_ref": "indicator--b66c2f53-394b-4375-881d-406a96108ed6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de7c8281-5d09-4ffd-9ae0-09cf7c6805ff", "sighting_of_ref": "indicator--4d9f277b-a5fb-4b08-94d4-ad2b69001b61", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f822b75e-372c-4632-b7c0-b32693310a9c", "sighting_of_ref": "indicator--579601d0-4308-40d6-9484-75cbd9a58cf5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--328c6d22-2e28-4e34-abac-22ed4065e5bf", "sighting_of_ref": "indicator--a27c6d42-25c9-4dbb-be08-8419d3ec2dc1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ba83d4b-7921-4ff1-88d1-83e7213c2119", "sighting_of_ref": "indicator--af938f69-0e14-4eb8-8a3a-15c86e5d3dcf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d12b9a0-0708-4262-9890-0cb01f811167", "sighting_of_ref": "indicator--429e516e-12fe-4be5-afc7-e19a19323ab0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b9b039a-0364-421f-aa0d-a9e65774614b", "sighting_of_ref": "indicator--38574826-2f00-4e3d-8f57-a1d7dfcc3690", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b83d516d-0d98-421a-bc85-13ef68abc041", "sighting_of_ref": "indicator--640c7b41-5a43-498e-be20-c3cce5592384", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab25916-64a8-49b8-9174-f38695c24f87", "sighting_of_ref": "indicator--accee324-2d93-400c-a58c-47efc9ef8a36", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91fa17d5-08f6-403f-8c70-136d234d9eaf", "sighting_of_ref": "indicator--700c4864-9ed8-4839-94dd-ef2f9fb587c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--073a1b14-9f76-4fd9-b20f-188e262b6041", "sighting_of_ref": "indicator--1a267ce8-e2eb-4b50-a81f-b6b9b9215aae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20f0172e-b39d-473f-b581-3939814389d0", "sighting_of_ref": "indicator--46f3e91d-1544-43e4-9ee8-4708b242040a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5fc8367-624f-4716-bfcd-f2e762286399", "sighting_of_ref": "indicator--cb1fdc98-24be-4d2c-995d-05e98c00dc5d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ec0c856-925f-42b9-8e16-494f96904bec", "sighting_of_ref": "indicator--c90a2799-f2e6-4fef-990a-eced736a0410", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9303d409-7b86-42d7-a95c-66d3bd4b5186", "sighting_of_ref": "indicator--b1c71282-0996-4d32-a6e4-76b10c60b96b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da13f440-15c0-435b-a2fe-59b9e46a14cf", "sighting_of_ref": "indicator--549af79f-6f9c-43d5-98ba-f14f8897a6c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67e76122-1615-4881-abe1-a744f9d71ecb", "sighting_of_ref": "indicator--c7895f21-23e7-41a9-b0ee-8624d6d2085e", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11edf129-1952-4090-b018-2a5e904aeb78", "sighting_of_ref": "indicator--0b1ea4a9-8048-4bfd-bbf2-a1d3e94b6153", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d19af8b-452b-448a-8aeb-1bc5e9c78d4b", "sighting_of_ref": "indicator--478116e8-c404-4512-80d2-5672b5e9a2ee", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d7295ce-0f50-4296-87b8-2a269fefe391", "sighting_of_ref": "indicator--7099a87a-ddca-4887-bc12-8c2c0f143bc0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47a0702c-5af6-4899-9c9d-63001848b592", "sighting_of_ref": "indicator--7792afcd-cad0-46f4-8242-3ef43247928f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf566a18-9dce-48d4-9252-cbf9baaadc53", "sighting_of_ref": "indicator--68311695-1cf5-4b74-b8c6-f228a6294095", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6b3fb77-7124-4b50-a5eb-a5ff39d9fdaa", "sighting_of_ref": "indicator--f16ca8b5-f0be-4833-a372-5c836010e46a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--365b7a9e-f6ac-4f88-ac07-4931ed2bfa2e", "sighting_of_ref": "indicator--d628ffab-98e9-4a30-ba14-8da0ec98d8d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c0ae697-426e-4652-86f3-1e952489fa5d", "sighting_of_ref": "indicator--fa590076-b9f4-4941-8efc-63e3b7c7af1c", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83b697ca-4b6d-496a-8bfd-0a58235b90bc", "sighting_of_ref": "indicator--1772d0d7-4d0c-4fb4-a6bd-0977a54e365f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e04b261-6463-4697-8d7d-c5909fe38f10", "sighting_of_ref": "indicator--711c64c0-926f-43e5-9617-677f32079ebb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a65ea49f-8464-41ff-b373-403a873844f6", "sighting_of_ref": "indicator--d3b96f95-8160-41a6-8a4b-5ec99179ab9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8868dab-cd25-47a7-94d5-65aaf195316b", "sighting_of_ref": "indicator--9a988d67-59ab-4a54-91d0-4f4608d9c4c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32362117-2710-4291-8e0f-eca0da10da52", "sighting_of_ref": "indicator--6d66360f-8dbe-4d11-8298-67385f859b4a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a6ab361-4468-4e00-a3ea-232113fd4434", "sighting_of_ref": "indicator--587c49bf-c632-469e-b3b0-6fa1f7e37e10", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b594598-eb20-4656-874c-84f14a0bc3da", "sighting_of_ref": "indicator--11605dbd-a0ff-4c65-8101-8f3f2bd71db8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af86aab3-4cb9-4f74-9ccd-8a1cebd0ff4f", "sighting_of_ref": "indicator--59c9e6d1-9af9-4293-9820-d8c94bbb3ffc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--687f7667-d3b2-482c-b37b-f82902047ba7", "sighting_of_ref": "indicator--3a7904a0-e888-44d0-b10a-438886db7918", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0415c90d-3c81-4d73-b4c6-c648adeb873b", "sighting_of_ref": "indicator--eb332111-0322-4c35-97a0-973bcb4a6896", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56ea98dd-4e88-40c3-99b9-8ffbecec1c26", "sighting_of_ref": "indicator--a38917a4-cf38-4c02-9b79-bb5683f1381e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15e18b31-6031-47c4-8398-4f557bf67b04", "sighting_of_ref": "indicator--df846e61-62f5-40c2-90a6-0fa738194c6c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1af7a64b-1367-4fc0-a7b2-ffd360bc9d5b", "sighting_of_ref": "indicator--ec801e03-dd8c-4247-905e-a3180d9af66d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60f6aebb-5cfb-4f21-91ba-12aae82cbc2a", "sighting_of_ref": "indicator--bb150aa3-ebc6-4297-b8e3-c31b0fd90d29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86e93a3c-9c82-4c9b-bfc7-2bb69d1910d5", "sighting_of_ref": "indicator--e8fdb3c7-7bd5-4f8e-bc40-90caebc4ac72", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3db36b1a-0763-4fc8-a934-3722f3e5e003", "sighting_of_ref": "indicator--827b0b38-024a-4da7-b80c-a8a710bbfbc2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a94aea3-d23a-473a-83cb-4bafa78d4faf", "sighting_of_ref": "indicator--4bf1653c-1129-491f-9e76-592e683b1af6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ffa4701-cb1c-49ad-a7ca-bc65f204ea5a", "sighting_of_ref": "indicator--183d6721-0696-406b-b65e-056f34dff85e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--817e4f30-0be9-484d-a7d8-d24483c7631f", "sighting_of_ref": "indicator--18f53be7-d806-4f32-b3d4-a74cbc120696", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82bf83b7-7b6d-4296-bb8a-eafec3a8eb79", "sighting_of_ref": "indicator--96960b86-c5cc-44df-ba10-1d8ae081a5b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af8eae2f-ee5d-4063-a35c-4fc5eb16c8d8", "sighting_of_ref": "indicator--04fd0e82-d2aa-481f-89ae-0be8c3f11225", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa9309c8-e9c6-494b-8ede-6c2339ddcf5d", "sighting_of_ref": "indicator--dba14906-0f09-4e0b-8922-21b64d3b23de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e67bdb27-c7e6-426e-baf1-669a61481e06", "sighting_of_ref": "indicator--6116b777-d19f-40e6-b184-3959ba6c9fed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d70c958-0b9d-4830-a507-03e1973dc940", "sighting_of_ref": "indicator--9a1dbcde-7379-4b43-bda4-d1ee9b527497", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93cd2066-93b5-462c-80d6-ad41d43530b2", "sighting_of_ref": "indicator--a1de37b1-414f-4985-b975-a47e9524f2e8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42a42329-ca51-47d0-b9a3-c119bf330074", "sighting_of_ref": "indicator--a16b9d13-2771-4e3c-8fa1-49a21d8fb21d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a68567d-7098-4dfa-ad08-704bf505bbc4", "sighting_of_ref": "indicator--9232ecaa-a885-4ef4-a643-b6136078770a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c77e926-4a51-4406-821a-b673e76c9b4c", "sighting_of_ref": "indicator--20733880-5d59-47b8-bcb9-c180893b5395", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0088bd8-2d56-44bc-95d5-9e5207ad1c00", "sighting_of_ref": "indicator--a6f77e77-3814-4053-8515-f8060a84e00e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daf20a30-41e8-4d5e-8231-9e5f488fc36c", "sighting_of_ref": "indicator--3a78712b-44fd-4233-b1cb-0f02dee4075f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a1dbebd-070e-4c92-a927-a7e762ceab6a", "sighting_of_ref": "indicator--40ff10cf-7709-47c3-b392-0c95eccc1573", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--945c9fb3-e54e-4ebe-893a-6ac3351663c0", "sighting_of_ref": "indicator--10eaeee9-daa2-4154-9797-1c91b20c0eb5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bdb9467-afea-4d2f-929f-f6b42ef21f34", "sighting_of_ref": "indicator--0e4410a5-cb7f-4f01-bac2-6af204ea3f98", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d27e0044-abbf-40c8-a712-84fb26e4f771", "sighting_of_ref": "indicator--2e87cf45-7c26-453a-87fa-910a016f4260", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15ba5d29-fac9-4e13-a94a-b2c8c3eadeba", "sighting_of_ref": "indicator--8267e53f-c30e-4bf7-aad4-12f40f811472", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6f43b1b-43b1-4b16-bd5d-89b07c7ec7ca", "sighting_of_ref": "indicator--8267e53f-c30e-4bf7-aad4-12f40f811472", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1b335e4-a779-497b-8728-af0904cd643d", "sighting_of_ref": "indicator--8267e53f-c30e-4bf7-aad4-12f40f811472", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e76a3ab-ae01-4b8c-acb7-3c5602c0530c", "sighting_of_ref": "indicator--c0858879-49c4-4102-b98e-4508b149e649", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d488c87c-dde6-46c9-9035-abb543d54c0f", "sighting_of_ref": "indicator--6837b6ae-c7c4-4048-a38a-788e81214b19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f3d6c4d-7fff-45d0-9401-4ed6dfec006a", "sighting_of_ref": "indicator--9b5b6fa0-9ddb-4b62-a623-b030499cb31f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c20fd4a-52be-4d5e-af3c-f5bfa6d602b3", "sighting_of_ref": "indicator--afa80e9e-9b90-4952-a492-4946453b2b55", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d19530b4-ec8d-421d-8a9e-6c350a0f098f", "sighting_of_ref": "indicator--5a45683f-8245-4245-a7ae-6567b152ebf3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beeeb317-1d33-4503-a75d-8ff71cddbe3d", "sighting_of_ref": "indicator--9d169904-66b6-4034-829a-19cb2ba9ce97", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38f85844-117d-4e1e-858f-14d70971b84e", "sighting_of_ref": "indicator--cbffc567-7e59-4bc4-952f-4164ca1ddcc0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0ff8326-7387-47cd-9b83-610c33e2417d", "sighting_of_ref": "indicator--203d87af-fde1-4697-9e0f-9bf235f6a7cf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aec55108-962a-44da-adbd-d72808e236f6", "sighting_of_ref": "indicator--eb4ab240-27a6-493f-8fa3-fe978da8a5b3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e2d062c-58c4-4540-93bb-0f4aec9857e5", "sighting_of_ref": "indicator--9e371f7b-fb36-4397-9c9c-bd490b4f30ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cd5aa60-4a41-495e-afc7-eb8f90e5178e", "sighting_of_ref": "indicator--98b2ec9d-9ee0-4d31-a47c-eebaff806a69", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9c62f35-e8be-44c4-99bb-84d9a6191427", "sighting_of_ref": "indicator--a96c15bd-7cd3-4742-a030-641c0700ec18", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c85a2687-c1db-49b2-b89b-1d11e6c4ee2b", "sighting_of_ref": "indicator--2d6bb78e-1bdb-4e50-bfcb-4e3d9250cfab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a871ab26-0e1a-4c51-ac38-0f3b739cfeb4", "sighting_of_ref": "indicator--b73b69d6-4177-401c-8244-fb808f5246b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71c98991-5fe1-4e61-a4bd-c9ff9bb0d87b", "sighting_of_ref": "indicator--b5363bdb-f64a-4ded-817a-5e78e8b3be31", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d6d52bb-6010-4ac1-88cb-7554cebf83f9", "sighting_of_ref": "indicator--457d7b02-f786-4cd8-85b9-de82c274efb1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ddfcefa-f1cb-49d5-b7e1-7f691512a5f4", "sighting_of_ref": "indicator--b3ff2985-0e21-4e4b-8470-7f3183490cb4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d95c097-b266-405b-ada8-d737f3f247f4", "sighting_of_ref": "indicator--97eca48c-6e8e-43ce-a466-7267c35d285e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd2b8d4c-9e9b-4b97-8c58-2b821f3daf90", "sighting_of_ref": "indicator--cadf14c0-9b8b-4a77-808b-234ca71a50af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--363d1133-1591-4955-b76f-72417ff382fc", "sighting_of_ref": "indicator--afc9ebc5-d3e3-4fc5-9203-f8c1db5074fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c92d5cc-bbef-46eb-a53f-4ee838c70d8e", "sighting_of_ref": "indicator--134e36ff-61c7-4729-bcdd-fe5eb0a93bb4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18a9f6f4-bdfe-4441-b631-ebd16aef4e58", "sighting_of_ref": "indicator--955e2935-05d8-4600-9952-6c3677c212dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d39a1e35-6f78-4b8c-9f7a-c8326571eeff", "sighting_of_ref": "indicator--f835cb33-00a8-4c08-bba0-07d827a14c99", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3494b78f-6b5a-4bd4-b61a-24564f51e633", "sighting_of_ref": "indicator--904668ad-2f21-4f6c-a348-10effbb9ab04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35e15268-871a-4323-8d81-a746f593394c", "sighting_of_ref": "indicator--ba09fada-9cb4-46a9-ad98-a0b7581c7db5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5019b547-d195-4eac-8754-50e262ae1bae", "sighting_of_ref": "indicator--0397b269-c4bf-4dce-9226-f1e4a4ff3faf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0749f5ae-7957-499c-abbf-41605f980815", "sighting_of_ref": "indicator--007597bb-b73d-4ef3-b35b-4bc8c1c551f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--334598f0-1d74-4799-a3b7-520be200da2f", "sighting_of_ref": "indicator--eb8c782a-f8c8-46d8-ae93-4f18963ddcf7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e97f29a-b9ed-4541-bfba-26b33b2a06f7", "sighting_of_ref": "indicator--8a158d1b-323b-4826-9dd2-00b5b2251a34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4090323f-49e8-4557-ad85-ac92fffa1a33", "sighting_of_ref": "indicator--7e33380e-c49b-4a69-ac96-47e7fe23dc46", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ea456c-94c2-4eb0-8211-980916a8897b", "sighting_of_ref": "indicator--15c3992a-8177-4cb4-8816-d2810928beb4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d6872de-de56-4f88-b1eb-c1e93a1e2a7f", "sighting_of_ref": "indicator--602b7480-82b8-41a5-952c-bc499ed69c04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--548b5e40-6ad9-4a67-8838-c2fe6c882f70", "sighting_of_ref": "indicator--193de47a-ee8c-477b-8aa9-cbfd1a9922a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7660323a-58ba-45d2-8848-8b6ff5403f8a", "sighting_of_ref": "indicator--f30f0b4b-50cc-4b20-8e09-3b744f39913c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83928930-1515-4bb9-a1fc-0842a4ffa9b4", "sighting_of_ref": "indicator--d3a8fe45-11f7-43f2-8c1a-8c6f03b77a7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--660b0ff8-ae43-4372-86ff-395e027127cf", "sighting_of_ref": "indicator--f324f6b4-f763-45e4-929e-3e10b21998ad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95414cf8-fcf7-4a02-9fc6-82e5761ef061", "sighting_of_ref": "indicator--2825f36e-bac9-4215-8922-05aef63415df", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e8ad5ae-4eb8-42a2-9f4f-ef744f2ec07b", "sighting_of_ref": "indicator--a1ba5031-9185-4cff-a855-b08ebb273942", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce2c70bc-d6b7-4b80-875d-effe89ab8216", "sighting_of_ref": "indicator--891fdb4b-d7c8-4dcb-9dc9-c2a371b0811b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c5793cb-ecd9-4769-b6d3-7de5c9008ebc", "sighting_of_ref": "indicator--6981107c-61dd-410d-9fc4-07ac1c27bea0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4b5e758-6a47-4df3-8afa-b0cf1af8d687", "sighting_of_ref": "indicator--f5f2d7dc-b867-47db-87e2-471eb3fc2811", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12b6e78b-e756-4fdc-8800-fc67faa07877", "sighting_of_ref": "indicator--7985fd7b-8a63-44e1-a952-92f5e069ee9b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5f51b10-e015-4bf8-83df-acc5ebc93f5a", "sighting_of_ref": "indicator--73816428-1c33-41f9-b882-b243fc6282ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c339c7db-1c3f-42c6-aa71-606a4a87e8e3", "sighting_of_ref": "indicator--648acabb-8248-4d46-a8aa-b9845d449e2c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b728ac4c-69fc-47bc-87b8-b2210b8738d1", "sighting_of_ref": "indicator--68b5f93c-2539-4382-a8d9-eaacb651e955", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcd71004-6982-4060-9ce8-5a8056bfbb46", "sighting_of_ref": "indicator--c50cf4f8-6a87-4d0f-9b4c-26780f5d0baa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d4a2b71-eb59-48cf-9837-7e267b806abe", "sighting_of_ref": "indicator--c2840a68-93cb-46bc-af01-d8de8dc31c58", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05aa3c2b-c1d4-491a-a526-a8443b24709a", "sighting_of_ref": "indicator--45428f3c-b228-4010-9a48-de099604aab7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac86ef51-111e-4262-a750-5cf8d7823aa5", "sighting_of_ref": "indicator--8f3b0a57-cc63-499f-a478-50bbe49f36da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e80ad06-b36d-42a8-aeae-4ed339062d97", "sighting_of_ref": "indicator--40e71f29-3d83-499a-8fc9-6856b7a4ec26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d5288da-9c46-40f5-9a47-f397a1a92503", "sighting_of_ref": "indicator--4e82774e-c4f2-4cd0-92b2-77abe76b6fef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--460584fa-e936-4227-8cfa-cbcb9f0856f2", "sighting_of_ref": "indicator--0c90e45a-a8c0-4135-8927-8b949043283e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bceffa9a-42de-4e82-9302-cf42ea2b8355", "sighting_of_ref": "indicator--5d02e005-de5e-4d1f-9677-e8eb513cec07", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--028a82ba-10ec-4342-bac5-987add397f89", "sighting_of_ref": "indicator--45e3aaaf-0910-4052-bc87-acd95d811141", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--301e2fb0-9f40-4e05-8faa-5d0b7e068afc", "sighting_of_ref": "indicator--9df3e62c-c6e7-4672-8f8c-c2c36e1dffc8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11a9aea3-6e0f-4bc0-9845-5be30c048bc8", "sighting_of_ref": "indicator--0d575004-16dc-4c3a-b8f0-6327a7e4f6e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae1ca5b8-373d-4342-aed1-1bd4d3e19fa7", "sighting_of_ref": "indicator--4cf94b0e-8101-40b2-80db-cd904ba5150e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47f91b7d-d97d-41d0-931c-faf65cf5b8f1", "sighting_of_ref": "indicator--fa1ec4a8-65d9-4e06-a652-a01202d249ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91f25f60-7c57-4904-8b1e-e5004ca2f51e", "sighting_of_ref": "indicator--d3dbb1fa-97ae-486c-bbcc-433d04e40a4d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c3d5951-381e-4541-b37d-824f89435c11", "sighting_of_ref": "indicator--eb3a3962-d6dd-4e11-bb19-0dccdc5bbe4b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaf96fd8-7d38-4e5c-9b69-1c68a38374c3", "sighting_of_ref": "indicator--5e8d3475-366b-46f4-8f57-42f682a129db", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d0def80-43d6-4423-83ec-00e069a35eba", "sighting_of_ref": "indicator--86ea7101-52fa-4fb6-a960-2e30c9f10a3a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43c22f1c-a074-4e76-bac3-4fcf144b9dfe", "sighting_of_ref": "indicator--e05cfc98-50b9-4c3a-bc22-0dab632ab331", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93eb5c79-66f9-426e-8c71-1545683811d8", "sighting_of_ref": "indicator--36c42149-009b-4a8b-8426-8db9c3376a56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0eef210-12b3-4e2c-b1c4-d3828ea7d5f2", "sighting_of_ref": "indicator--58b21579-647a-4f90-8de6-ae40b0615405", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e955897a-2afe-4385-86bd-523a9db630d9", "sighting_of_ref": "indicator--4ee8a7ad-7bc7-4d04-bf23-0d8eecf6972e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7805d786-60d7-4d60-befc-f07788b72b65", "sighting_of_ref": "indicator--1819841e-572a-4df4-9de1-b0e849d00b3d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb5b12ad-6d2c-49a3-8a75-4e007d42c92a", "sighting_of_ref": "indicator--a48bfc42-d82f-4e09-926a-84f6c18085e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc44a553-b121-437e-bea7-a280770e8121", "sighting_of_ref": "indicator--e73d5c4f-9556-4ebd-a2d0-87a95b119b2f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--502cc65d-5303-45b4-b3d7-2a1554b2e21a", "sighting_of_ref": "indicator--380a6f8d-3f96-496f-80b0-22e8fea823d6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ae6187-ab46-497f-acda-a8bfe24e1fa6", "sighting_of_ref": "indicator--198f4ec3-27be-4399-ae6d-450a812372e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35539e7f-5519-48ea-a2e2-c1daee7789aa", "sighting_of_ref": "indicator--86cffa99-da43-43fd-b579-1f68349b205f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f6a1570-a631-4c3c-b05b-fc74f1a9199f", "sighting_of_ref": "indicator--efd3a8e4-2e74-4090-8fc3-405acc7ba22b", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39182664-3608-4de6-99ad-ddb3655575d0", "sighting_of_ref": "indicator--9124630c-09d8-4478-865c-27b273aca551", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a5c9cbb-e8a8-42d3-bc33-66114392f9e8", "sighting_of_ref": "indicator--0e329014-7d56-4b0f-896f-3760a8269807", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e336ffc-9286-4d69-b6b1-78988f8e6947", "sighting_of_ref": "indicator--be195bdc-8465-4974-8584-9f09af7b3345", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5a7fe23-e9ab-4d6b-b8f3-87e0c3204bfb", "sighting_of_ref": "indicator--50cff91e-7570-4488-bfd4-497f06c54848", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a16c1a9-c077-4025-8fd9-25adad641442", "sighting_of_ref": "indicator--20633e28-298d-4e35-b8f4-0f25df9371c9", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84c88d6e-1333-4d17-b6b3-50bd414b2c3f", "sighting_of_ref": "indicator--99bdb62a-c298-441d-8f62-f242820a59f8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31df6ac1-ce72-47ee-b01f-bd22abec01c2", "sighting_of_ref": "indicator--7f3dd5bc-d7cf-4f26-b570-0db72c0ffdc7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20ce3c5d-a555-42fe-ba2b-5424c12758be", "sighting_of_ref": "indicator--d2646ccc-400e-46f4-9458-24eaa02fe9e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3356abf2-d907-4442-b194-72e042deda11", "sighting_of_ref": "indicator--de188214-05d0-4800-9dae-fd3149916c6f", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cd5922f-f732-489e-a857-5cf13ad64265", "sighting_of_ref": "indicator--ada09ebe-1c90-49f1-a5fd-1e4c2d361a49", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--122d4917-8349-444c-9b48-c58633b9dbcf", "sighting_of_ref": "indicator--9b59a807-6b50-48e8-9530-e82e358cd82c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--129e1d92-b492-461e-bb13-c1c40c9270c9", "sighting_of_ref": "indicator--b2e96ab3-2f11-421d-af98-42fa4cf6421a", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd6460a6-537a-4385-9dfa-f0c114829ec6", "sighting_of_ref": "indicator--e843a7af-565b-4b67-935c-d36c709d312f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0649552d-a816-4682-8286-2efdf76fb5b5", "sighting_of_ref": "indicator--63798842-5192-4779-b887-2e9b3496c22e", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7fba285-d3c0-4770-b974-21237ce7e1e6", "sighting_of_ref": "indicator--2f9065a3-ea20-4cac-8f6d-6cca38c7be73", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c6e290c-1e9b-4a7b-9f45-a39cb1832211", "sighting_of_ref": "indicator--04b9affa-6e15-4ccd-b7b0-0fce7d64463d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55dac296-7aa4-4fb9-9e10-990d5005801e", "sighting_of_ref": "indicator--da892fc5-d20c-4c85-aff9-ebfbbc84930d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad303955-88a4-4e78-abbc-64c51ed947a9", "sighting_of_ref": "indicator--fd453770-101e-4df0-841e-0df20a941c71", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--608b2c9b-adb6-4790-9c29-dc77aa9e5140", "sighting_of_ref": "indicator--3d0d84f9-34d9-46a9-bb6b-f2f3fce0139e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59645115-8c09-4d49-9cbe-3b38d8b66dfb", "sighting_of_ref": "indicator--3ca1b21b-75f5-4b8c-bfdd-8d168f482eef", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56588a65-2ed7-45ac-bac8-a9267ae6a259", "sighting_of_ref": "indicator--3d1c3ccf-741d-4d2d-8161-ed77169b1f8d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c163c7b5-7a9a-4161-a259-38a4ba3b7db4", "sighting_of_ref": "indicator--40cc4300-8699-458c-8d23-2ee4d8539a13", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd9f5f6-788b-4c7e-9bc9-0aaeef6a4054", "sighting_of_ref": "indicator--8aa33d19-5113-4c21-9283-8f8252d08978", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc2dcad8-f476-498a-a30b-634d904053f3", "sighting_of_ref": "indicator--90dea37e-0869-4e20-8450-c68ae0c57082", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16b86c14-0665-4e2f-8b22-908b12fcd827", "sighting_of_ref": "indicator--bc55e986-c247-44f6-877a-ef6f09791481", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4547fbdb-0948-4eaa-9d56-f0013e010079", "sighting_of_ref": "indicator--ce1c3ae1-ef98-4eed-aaec-70d0f34fae0c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--922ce036-5dc4-4de3-817b-48d4046d9f96", "sighting_of_ref": "indicator--200664a7-fcd8-46ad-a4cf-6513fc5fc4da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02a9f8d9-171f-44bc-80f4-2e6082a0c6f4", "sighting_of_ref": "indicator--f55aa858-bfb2-49cf-8729-7069947decf1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02625494-f3f9-4df1-bcdd-2a7783de7eea", "sighting_of_ref": "indicator--0a6af71a-bf83-4794-9ee0-9fea2c221e25", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b14d9e6d-dc3e-449c-b9b7-b49b8128ab54", "sighting_of_ref": "indicator--82bbb6c7-3b3b-4034-8969-de8f291b896c", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a01b31be-713b-4809-b63b-5a7daec5b11f", "sighting_of_ref": "indicator--fc1ca520-37a9-4b44-8776-a46d4e785832", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebff1795-5f21-476c-b299-6ee0297d31a3", "sighting_of_ref": "indicator--02218e6c-d038-4e44-8d99-5bf6c1ec16e1", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0be07ef-934f-48ea-9f6e-3b4ad0f345eb", "sighting_of_ref": "indicator--6881fce2-9072-4c33-b82f-fadb5fd3fdf3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc91ca71-dca7-4690-bd11-1ad39d867a33", "sighting_of_ref": "indicator--80f58702-b533-470d-9890-6441b85accb6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3469c51-66aa-42dc-a6d7-3596fd402510", "sighting_of_ref": "indicator--2fe2454a-ab65-4455-9859-498c67551a04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd3472f3-4d03-453a-86e8-755a8e10b359", "sighting_of_ref": "indicator--f49a7a7b-dfe9-402b-9723-7f8b4a44fd47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--290bac2d-be78-4ff5-a003-7ff5d162f10c", "sighting_of_ref": "indicator--80342d7a-e4b2-442d-b9d4-020385e4fc06", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fc436d4-f0ee-48a5-8373-ee46edbb4f22", "sighting_of_ref": "indicator--9d9e5727-9e4c-4730-bde0-abb51eb69b09", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16cc7923-b2d0-43d6-ba27-937342fe2876", "sighting_of_ref": "indicator--9c116cc8-00c5-49bd-a3c4-6fdc37d07e53", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e084de15-5d5c-4deb-bb6d-881a709a88d8", "sighting_of_ref": "indicator--2571cc02-f4e9-4459-9b38-28d0445a5ab8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94171fbe-9b4d-4907-a065-a36666f93bda", "sighting_of_ref": "indicator--130b198d-a0b5-435e-aa83-6d167b0480e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b536a637-c56a-460c-8591-64950290a80a", "sighting_of_ref": "indicator--facbc870-7e4e-474b-8272-1d03b322613e", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a99b3ffb-8341-41ab-b096-c3ffbc46a37e", "sighting_of_ref": "indicator--bd7a4e76-f43c-4864-99be-a22c7fa3190e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ebeb40f-e08d-463c-b94d-959b71f82108", "sighting_of_ref": "indicator--7d980985-76ed-4c6c-a11b-adbb7857bb9e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa2a881e-3cee-4525-91e0-24a8814845ae", "sighting_of_ref": "indicator--ee6c9e92-6c26-4bc1-adbb-247e03f878c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad98db48-2c49-4626-9164-326326c140c4", "sighting_of_ref": "indicator--117fbefd-95ed-486d-b742-c2824e6d75fc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cd55a95-7066-41a8-94da-9412f837eac5", "sighting_of_ref": "indicator--a0abebc9-0488-45e7-8647-6165296ddba2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a02e3caf-3a88-4082-bc22-0fb3191f83f0", "sighting_of_ref": "indicator--e3f58adc-251e-4342-bc7f-9f7b1f0af70f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--710d0cf0-f375-4d68-8729-2108d7d9f814", "sighting_of_ref": "indicator--b7ee0f60-b1f7-433a-bd73-8a2d29b18b5e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6e7d515-497b-4b24-80b1-5bdc07b24e55", "sighting_of_ref": "indicator--a9b16964-e62a-452d-b338-73c5ff9a546b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c81b0dd5-a8c0-4ba9-86c9-1ad4dbc9c418", "sighting_of_ref": "indicator--53802c3e-101e-4687-b2cf-af7b0ae1fd7c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8240a44b-560e-451c-94c0-1a6906e513a8", "sighting_of_ref": "indicator--0cb104f6-d7b6-4ed3-bd67-6d82851d8093", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8cd92c1-f844-423f-a9ae-60b8d167ec54", "sighting_of_ref": "indicator--7fc28c02-8e5f-44c7-9ba7-6110cfbdc5c1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9be903cb-710b-4162-864a-ba1261103301", "sighting_of_ref": "indicator--975630ad-d01b-49b0-bbbc-4213d4f66cef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b48d7dc-ecef-4d7c-a8e5-e3214f6c5d73", "sighting_of_ref": "indicator--348d619c-250c-46b9-b2d1-36f3afbb6089", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0ab66d7-5c5d-43cb-b0f5-870f2eb25f13", "sighting_of_ref": "indicator--ac298aea-8079-44ca-9d4e-ef4a74654e91", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--221c1873-c76f-4cf2-87bd-bb34fd8bfce6", "sighting_of_ref": "indicator--1472c138-a144-4430-970e-4074124adfe7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9449ba91-44e1-4c1c-9d43-2f99c94da58b", "sighting_of_ref": "indicator--fc3fe521-d89a-42f6-8f7d-391ec3f9a63b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7825702-95d3-48b8-a096-4bea49bb3775", "sighting_of_ref": "indicator--707a374e-d159-4f0c-9754-64deaf0675cf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0685d9c3-41fc-4da8-80ac-0e0991d415e9", "sighting_of_ref": "indicator--f692c24c-606f-45e6-8603-81cb0196c172", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9caa75f9-0521-41ee-a11a-b8fb9b6a8ab5", "sighting_of_ref": "indicator--0ff1d863-d535-4a56-9c15-17e0d930b565", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dee2f18-1d0a-4a4e-aa36-9abedcf9561c", "sighting_of_ref": "indicator--a3a4bf29-6ded-493b-a34b-820bc0c70920", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fd21cfd-6480-4cd2-9de0-5ee9276cad8b", "sighting_of_ref": "indicator--0c9de37b-3c84-43f9-a451-f6f2f1889663", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21034ba0-f873-470f-b98f-06a0e895a0c1", "sighting_of_ref": "indicator--efe7f90e-d69a-409d-b4f0-6b488f23ada6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3406e97-30f6-4df5-a0a6-8e53ce4bebb6", "sighting_of_ref": "indicator--30ddb8a6-e70d-49c6-a281-c0f8f0fd676d", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8da73a49-7523-43b0-bd14-8f81868be515", "sighting_of_ref": "indicator--2308e66a-da3e-4d10-b79e-49af90a457d2", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05f6811e-4a83-47e4-932f-7a707930be46", "sighting_of_ref": "indicator--10d3d40e-b70c-4129-87a0-5e449c9ae930", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc8c73d-a463-4737-b978-9bfc02619f16", "sighting_of_ref": "indicator--b8b02ae9-bee0-47d4-b158-44c2ffe33560", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc5b51c9-d8cc-4c76-a175-9cd1461eda56", "sighting_of_ref": "indicator--3b080ba3-9f6c-476f-883d-9531bfa9af17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75397e89-97d2-4759-956f-9cdb8fad10e8", "sighting_of_ref": "indicator--93e19171-52bf-4e1e-b213-1ae8633d8d54", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e09944b2-46a3-4850-8057-1601fbfe2cc6", "sighting_of_ref": "indicator--cc44677c-4d8c-4e98-9968-c3978e36d80a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b77a7745-2865-4d55-89df-8e4ad5ea68ee", "sighting_of_ref": "indicator--32bb3ecc-28e6-42e8-9a64-b681f24ffb07", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94ae4924-ac00-414b-bf2a-3537560eb5f4", "sighting_of_ref": "indicator--8320d4cd-aa89-47ba-8393-00a5cb3822bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87d135cc-04ee-44ef-ad8b-4ecc837f2aef", "sighting_of_ref": "indicator--b442566f-3415-4c6d-9022-93c8097d4385", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f7e08ee-8bab-46c5-a8c6-ef1e5021f031", "sighting_of_ref": "indicator--055e3fe6-1a5d-4c90-9383-8333ccd0c559", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--999bf9ed-bcf9-4fb8-9c17-69b901ed7991", "sighting_of_ref": "indicator--1f1824b2-239f-445f-8a3b-2c25b1922926", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8132b36-018e-4de6-89c0-817e2db403b6", "sighting_of_ref": "indicator--d6de369a-ab83-42de-82be-42121a74930a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25fee976-18a2-40bf-a1ce-ab9730c867a1", "sighting_of_ref": "indicator--7f4b9cde-2cc7-4dc3-8dfc-5fffc0ff3bf2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67ee9f2d-cee5-42d2-8d08-f78c1d99b997", "sighting_of_ref": "indicator--c24a4b1a-caa9-4399-a152-b1c7de0308ce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d95f25eb-e87e-47ed-ae08-9854590c71c3", "sighting_of_ref": "indicator--ea1f0a48-a5cd-43d5-a136-8f4a7ddc5cfd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--987a5c8f-1821-4f15-a5aa-00d6fc141093", "sighting_of_ref": "indicator--ae3f3470-a79d-4040-b74c-61ccea910586", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54d8c0d4-1b94-4edf-b0de-a1df04183958", "sighting_of_ref": "indicator--98456ba3-a33b-4025-bd92-3d2e1f161ed0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91d2f88c-205a-4505-b158-ed6016c7fb39", "sighting_of_ref": "indicator--3b950e41-abd0-4a19-8aa2-616a73b65f62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4168ca37-7eb2-431f-8b13-01d915a71d47", "sighting_of_ref": "indicator--405632d0-79c7-48e6-98da-986b5a790dc0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99952361-68fc-4710-a735-f7ef79e64a0c", "sighting_of_ref": "indicator--d3c15d07-f7c0-4d27-8f31-1a488efe3e74", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d083d1c4-7fe7-4971-993d-30f5dbe4c01b", "sighting_of_ref": "indicator--b4c0dc2a-876b-4597-af4f-3c99eb9b021a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a86e5bac-3e11-4eec-9a3a-bae0d4952a2f", "sighting_of_ref": "indicator--d8c91870-5c12-4478-8fa6-89298a4a0e62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf2ce1b9-4b1c-4a96-b6a1-665ac0a0b310", "sighting_of_ref": "indicator--f44c183a-b6e5-463e-bcbd-718698c6b30e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a930232-cc64-4dc0-8575-c435c887d515", "sighting_of_ref": "indicator--eabd2b20-ce91-4208-b000-05766dadb0a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd0f4b2c-093c-4088-9dcf-8c773386fe80", "sighting_of_ref": "indicator--20917329-81a8-41bc-88ff-49ba2adffce8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07758aee-cb4a-4472-92b9-1c3ba2d55f30", "sighting_of_ref": "indicator--8f9041d7-f188-4326-abc2-0dd4a1b06f3b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e7b59dd-e643-458b-988a-da86f641a5ec", "sighting_of_ref": "indicator--472ac426-3453-4753-be7d-a7ba7f5b7c7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fa698c4-e7d7-4afc-9757-2946e2966377", "sighting_of_ref": "indicator--54ece9fc-f0b8-45ea-8e2c-ac6faef22e05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e9d313e-4161-44ce-9a70-c1d0825a9847", "sighting_of_ref": "indicator--a9fc3857-f39a-479d-9efe-b807f86ece9b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd55117d-3c03-4ee2-851e-0252fd96bebc", "sighting_of_ref": "indicator--9043b4f3-7d35-4024-bc5b-67cc9f742a68", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caf1c5e2-3bb7-4793-8056-d6c36f86e721", "sighting_of_ref": "indicator--9043b4f3-7d35-4024-bc5b-67cc9f742a68", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--621ad395-3dc0-438b-8a51-627efb4150cf", "sighting_of_ref": "indicator--fc47179c-1077-4456-be00-3c4c76950545", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a94cf71-b566-475a-9cc3-c258e97d54d6", "sighting_of_ref": "indicator--c0419e40-8bff-4ba0-b4cc-8622f8af01b3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00331b75-00db-4cb3-94b1-ef9358547172", "sighting_of_ref": "indicator--d8f04582-1d05-4524-b0ba-bff3f0ed7262", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00e0389c-8319-42ae-8b17-af1c67ca44ca", "sighting_of_ref": "indicator--cd613314-a791-4508-985b-eb7587265606", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7271da11-35fc-4564-952e-e569dc92000a", "sighting_of_ref": "indicator--fdf8132a-7eda-4d13-8e9f-a27dc0cdc46a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--296c00c1-8078-4c5a-aa15-75277de94fd7", "sighting_of_ref": "indicator--8382f03e-5263-4b7a-923a-5ed232d58ec3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b9e1405-7296-4689-ab6f-edc299e432ad", "sighting_of_ref": "indicator--2dc3739b-a704-481a-9822-c0c7288ae609", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46abe015-8118-4d38-9647-76c1dd0de865", "sighting_of_ref": "indicator--03d2958a-f3bf-4126-921f-84a7b3d63611", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d59dc8fe-f632-432a-a9b1-52fc92b1f78f", "sighting_of_ref": "indicator--c191b4eb-2850-44c9-b070-ac8c9a549fcd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8c05a28-9b49-4f56-ba32-485f5fbff89e", "sighting_of_ref": "indicator--14a90c7a-05b5-4e04-825d-fd1acc1074af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--341830ef-d999-42ba-a2ed-bcb3df9b9ef6", "sighting_of_ref": "indicator--b3c2575b-c2e0-4cd4-9c1e-0d92457718ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20220ab0-0129-4214-a4f1-ec7da32b2bc6", "sighting_of_ref": "indicator--e170034c-8685-4b59-8ff8-48a609aa451e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74e1a47a-bd3d-43e3-ab44-975426e4935a", "sighting_of_ref": "indicator--8fb71b31-6fb0-42a6-979f-ef7157b05991", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3a9665b-f19c-479d-8ec7-35c405278171", "sighting_of_ref": "indicator--61d2601c-be8e-4277-9195-3dbcbc21e270", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dec30af-c2e1-4fca-b0aa-145a7bc1b203", "sighting_of_ref": "indicator--bf3277cc-ba08-4533-a9a9-aebbb2f4bc1e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7d54d86-3cab-4fc9-8c02-9de2bdf992d6", "sighting_of_ref": "indicator--41f7ed58-fb8c-4eba-8c89-00f54b54a40e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--451788a0-06e6-4c27-8a08-d4853075ce3c", "sighting_of_ref": "indicator--62c0778b-7a2f-4844-8251-865f8a814cd5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c955dab-150d-4114-9908-6f1b4979c78f", "sighting_of_ref": "indicator--8e406797-858b-4836-9463-2c624c77a3fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfbf6d94-2f5d-40b0-8409-96dd5bba6b3a", "sighting_of_ref": "indicator--951a8e1b-a02e-402c-91fd-0b9a9fe5a61d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed50a3d0-0a3e-406a-aeb3-2dc2c2487d80", "sighting_of_ref": "indicator--9ed945f5-dace-486f-8c50-48ea6739e4d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9381ec8-cc76-4468-aacd-6320b02e19fd", "sighting_of_ref": "indicator--5ed84438-de40-49db-9bfa-d09d9d704b40", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df8038b6-dabf-4fc3-a0ca-ab71276bd8f5", "sighting_of_ref": "indicator--5ed84438-de40-49db-9bfa-d09d9d704b40", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e858e7c-f51e-445b-bac9-e40ae5453212", "sighting_of_ref": "indicator--6e1fef7a-e4ad-4c74-ae0d-7d38bad7e15b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7817480-1e35-4d6a-9ffa-112798e1046d", "sighting_of_ref": "indicator--8a15a0cd-ffe1-4d00-8833-3ed4e85bc938", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74230e95-b505-436a-b52a-4e9da06ac7eb", "sighting_of_ref": "indicator--6ebaf1df-dd76-4c87-973f-471632b782e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13262f71-c74d-4ba6-980c-6cd8477c3b98", "sighting_of_ref": "indicator--b447b46a-14db-4655-b380-5d631f6a272b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1dc1ca2-b8e5-4ab7-a2b2-1b8d3ce700c1", "sighting_of_ref": "indicator--b2b775d8-66ba-465f-ae46-52d6107c2764", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dae885f-9f08-4cb4-bf49-d6d8b1b60749", "sighting_of_ref": "indicator--ad5bcd46-5bba-4efd-8208-6e51c33f8c21", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31bdf67d-a3e4-4a2f-a3df-dde22d685dd7", "sighting_of_ref": "indicator--f29f556c-445b-4084-9d5c-91a3e378b20e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a68f6f8-a56e-4709-bfca-fb068c81e158", "sighting_of_ref": "indicator--1e03d015-ccb1-4f35-88ad-d90f02b7de20", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c77ceeb-b631-4334-b048-0f6eea21189e", "sighting_of_ref": "indicator--37abd40b-46c7-495d-afb9-09073714abd0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a983280d-82bf-48aa-932e-f6412ad90552", "sighting_of_ref": "indicator--8642c99e-8c14-44be-8173-c0f8ceaa91fb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfe7d75b-aae6-489e-9870-ed8d9b622e9c", "sighting_of_ref": "indicator--473aedbe-2ce3-41fb-a254-dec63cf2ce1e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7f32aa6-037e-4a27-b783-72825aac31ce", "sighting_of_ref": "indicator--67affc9a-548b-4162-a573-52978a813b3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2371e78c-7b12-4ec6-bb12-f3a61a75aee9", "sighting_of_ref": "indicator--52839a18-7a89-4f16-bc5e-31f2353fa627", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b16cc5c-3343-4735-b23c-e930ac85837f", "sighting_of_ref": "indicator--6ba44474-1326-4775-b273-41b3f3eab74a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--842bfe41-e154-4b81-a416-e6feb6086f74", "sighting_of_ref": "indicator--e67de5c8-53b7-4b03-8dc4-33dc23c2acaa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4951f4b1-4e5a-4990-ba21-2fcc19048c85", "sighting_of_ref": "indicator--2ca3319b-61c2-4d66-b361-79157ee260f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1048aa57-70ff-495a-8f2f-439308e8acbb", "sighting_of_ref": "indicator--e4bfa344-bc09-42a5-a340-cf7d022ccfe3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1708f34-8fe9-4ff5-926b-e9e5a9667ccb", "sighting_of_ref": "indicator--5fc403a6-1c1c-4e04-a2bb-c544ff444b50", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34fc52eb-245e-4ee3-8e76-ddbb601e821c", "sighting_of_ref": "indicator--2c094789-5566-4107-a007-dcd5362ffe71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fadcc9a-90f7-4e7b-82c8-a7a21d858ffd", "sighting_of_ref": "indicator--bf6b18cc-5570-4272-bfbf-122a4ba208ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea16a1e4-27c5-4e7e-a59e-a6791ca81063", "sighting_of_ref": "indicator--2ac19de4-71d0-4577-85f8-cfd484dc366c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf5b36b0-a6b9-4f3d-9fc3-7302e58b6f56", "sighting_of_ref": "indicator--a67828b3-27b7-48d0-ab79-a25e482c8833", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20fd044e-bf07-4dd6-b560-999c8fe3d8b8", "sighting_of_ref": "indicator--b57064b5-6d2c-41c3-ad81-e7a83ae25d39", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19be7167-4f5c-4a47-bfd1-4ad389b11ce1", "sighting_of_ref": "indicator--973574c0-6dec-4480-8177-632ddd2ad2d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--405a4616-1c29-47e0-a675-0f1cca8596ed", "sighting_of_ref": "indicator--ee2bfcc1-bc71-4f92-857a-749c93a267f7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--213b8450-5098-4962-87a4-7265c4ea4562", "sighting_of_ref": "indicator--ee2bfcc1-bc71-4f92-857a-749c93a267f7", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc917777-3366-4cb2-abcf-c18df3524ee5", "sighting_of_ref": "indicator--96a0b81b-86fa-4592-aa71-bb1329df4f8d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23d42905-8416-4905-bea1-83d7e6ac0f25", "sighting_of_ref": "indicator--e54121dc-edf3-4eed-9274-4f7745578433", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fb7ed91-255e-449d-87a3-3812975f1daa", "sighting_of_ref": "indicator--e564d49f-6374-4f28-9fef-01e0156da5be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7d0ed0b-41b2-4c16-afda-d1b0a2fc7ab4", "sighting_of_ref": "indicator--0b81d71f-8cad-4f4e-8edb-2956c199ca32", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a78be16-621c-4015-a826-ae44ef17ef8c", "sighting_of_ref": "indicator--d1751fa4-32ff-4aa3-a862-a64d54488b97", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0b79448-e172-4e84-9847-e501b805c512", "sighting_of_ref": "indicator--e969c497-2112-4a2b-97d3-2207337eae03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4b058f9-ea23-480b-a9c2-70fdbc98ddef", "sighting_of_ref": "indicator--57484cc6-ac18-46c6-8fb6-eb1d29d2a6da", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ac47e10-2c56-4657-b4f6-69daf16a855d", "sighting_of_ref": "indicator--57484cc6-ac18-46c6-8fb6-eb1d29d2a6da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38032c20-f27a-40fd-afad-ba4dd98545b4", "sighting_of_ref": "indicator--041f19ec-ee43-4551-b7be-0a5ec4a7b22e", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d3e079a-ad29-48bd-99e9-697ff9964fb1", "sighting_of_ref": "indicator--380d5bdc-c701-4aef-a35d-54fe1bfa1a00", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5e40e29-fb75-46c7-9a76-0085b72dea38", "sighting_of_ref": "indicator--380d5bdc-c701-4aef-a35d-54fe1bfa1a00", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--285cc465-b2a0-4554-8cb1-7b3a6f563bd0", "sighting_of_ref": "indicator--1ac09d7d-d847-4578-844d-1149f2d3e7ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60044478-3382-4ed2-baa8-104c29963245", "sighting_of_ref": "indicator--5df843b3-e538-492d-b780-ebcd27a67b0d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--305270f8-0617-42f8-9127-ad2e2bb757e8", "sighting_of_ref": "indicator--7df7e38f-5155-4fd9-b843-ed80e334c243", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa8ce6db-68fe-426b-9099-bc4adec7b510", "sighting_of_ref": "indicator--d3543dcc-aca6-4a86-99d9-3cd303f4dd45", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bf95cfc-7617-4f70-be21-7032a2ce44c5", "sighting_of_ref": "indicator--0215662e-3dc0-40e7-a2cf-f799881392dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce694153-2d5d-4363-8552-c8c415f600da", "sighting_of_ref": "indicator--5f0fcb91-1563-4094-90fd-33fbfe1373e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa06da52-9ece-4da7-a158-8f98bdcbba9a", "sighting_of_ref": "indicator--351d4776-f103-4253-b72f-46001f872975", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e179aa75-201d-4b30-b97f-4b3624839692", "sighting_of_ref": "indicator--ea84e5b2-b138-487b-b11b-927021499daf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b81cac1-187c-4397-aa63-4238e7defe49", "sighting_of_ref": "indicator--4ee69cd5-b989-4b15-8d6b-ae66fc80d6b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c22620c-590e-4a92-a4b7-58f1222497c5", "sighting_of_ref": "indicator--e8edf086-e96c-41ff-935d-d7ddd5c2e0fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c024c9b-0776-456f-ba4e-b334b946ac0c", "sighting_of_ref": "indicator--28bdc1c4-53c8-470d-bfbc-9b2ef8750585", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80de72a5-59be-4c43-86cf-a923db4789e6", "sighting_of_ref": "indicator--d7784207-bcd0-4938-b525-a38a9cebfc62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a83a0b86-e44e-49e8-8ebc-ab2d35140793", "sighting_of_ref": "indicator--0bf79d72-8296-4660-9ba3-2944764ecd9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41cbe469-6482-4207-bc2e-86129ba2bca7", "sighting_of_ref": "indicator--b831e731-f279-4622-a2b6-32b03e831020", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d13d936-57cc-484f-a4e0-254ed8c7a871", "sighting_of_ref": "indicator--be316160-86c8-487b-879d-2bbfd6f99a5d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e24116a-0b7a-4437-9cb8-a859c4fe4ae0", "sighting_of_ref": "indicator--2e1c41de-6340-44d5-82c2-08e5f6b07faf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e2278e1-635f-4e66-bafe-5cc6450807db", "sighting_of_ref": "indicator--90fe4e5e-00f6-48aa-8b21-ef20053726e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f60809f-2ece-47fb-a944-ee359519a674", "sighting_of_ref": "indicator--3e97172a-e6c2-4a52-a700-e1fd296c60bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47034e3f-acf3-4014-ad4e-5cf48f6c011e", "sighting_of_ref": "indicator--ffd232f4-c0a9-4adc-9b31-c92e91339d2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40b3cee9-4a00-40d3-af06-6333226df27a", "sighting_of_ref": "indicator--d28642cb-66bc-4c83-a722-1296a6d65360", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77325442-a72d-4452-8222-ddd7c2ca2b8e", "sighting_of_ref": "indicator--2a5b232b-a19b-498d-9c16-f3d9acbe2499", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5af0a9b-3aa0-4bf1-ad5c-0d1be9849bb8", "sighting_of_ref": "indicator--464e5033-790d-47a8-b83f-91e07a742fe0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa1709f4-1bc9-4db5-9e0e-15153a2a96ca", "sighting_of_ref": "indicator--c6220e54-4770-4337-8457-6556ed89f28f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--599a0018-4e79-46b3-9795-04a5f147f4ec", "sighting_of_ref": "indicator--da475c21-dd7a-4950-851a-6865534fb840", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba0e04a4-6724-43d3-9d27-de87f5f5d089", "sighting_of_ref": "indicator--69a3c9db-3cf5-4dc3-9e68-61feac7a8483", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3012403-b921-4fb8-a60e-01b13504ca4c", "sighting_of_ref": "indicator--1435fbd8-7a5f-47fe-a1d7-a787abf1075a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96e0c6e1-4cae-43d2-9dfb-add1a502d433", "sighting_of_ref": "indicator--b4f85189-9c65-4a31-92c8-21a9cb6ec09a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d1439ca-5c10-44f7-a358-cae6dede9644", "sighting_of_ref": "indicator--f5c16ce4-8383-4a75-a4ee-1b238ba6da60", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bf50545-5094-480a-a412-1ca3ea4b331d", "sighting_of_ref": "indicator--0130bcd9-d175-4ff9-9877-ad87115d9fca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41c5181c-7282-4eb8-a863-6e3548fa6e72", "sighting_of_ref": "indicator--ae16b247-0882-4d8a-aadd-38a7fdeb5133", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c07bd09-1ea3-4d9b-8c34-1c11a9f21f62", "sighting_of_ref": "indicator--f7ea9dc7-e0f1-44b3-b615-68f0a0bf8cb1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21a45a76-0a13-4651-a7d5-6b356c4b4df2", "sighting_of_ref": "indicator--8aea9dfa-4e8e-4e3b-9426-2503e5ef9cd3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb8dc6ed-eba7-4658-8e1e-ea759eaf3192", "sighting_of_ref": "indicator--ef36b6fc-73b3-4ecf-8c08-4fabc45b41cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8be8343-a9cd-451d-b4c5-a617630cb770", "sighting_of_ref": "indicator--76dac8e1-e624-4960-bb75-c4f20281adbf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7273b499-26ed-4b79-8100-1ba92d769167", "sighting_of_ref": "indicator--4b9d1ca1-5ac8-4589-91c2-2f72e734f17e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--551cf613-5230-424a-b16a-edf3d6f6ac92", "sighting_of_ref": "indicator--a090c497-07cf-428d-a40e-a39c6a378247", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f679880-b262-462e-a656-c5b6a5f1a092", "sighting_of_ref": "indicator--83b6232f-b434-40b2-8db5-227f521878c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f022694-25fb-484e-8063-0973108850cc", "sighting_of_ref": "indicator--4a3a6cc2-b657-4ab8-8951-239e71cf2c31", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7509eaaf-164b-46e5-a561-dd090dd6d3f8", "sighting_of_ref": "indicator--1a465617-6a1b-4aa8-98a5-32a343f5364c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3134e0f6-0c56-43fd-a80d-81e192d9d4f0", "sighting_of_ref": "indicator--4576494b-183d-46f1-ac1a-527a88a29c9c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df2464b0-2a53-41ea-a885-c759e6e22519", "sighting_of_ref": "indicator--ee16f99c-e195-4617-a5b0-41e7082a083d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc91494a-942a-44a9-adce-54adb7228486", "sighting_of_ref": "indicator--7d89935d-16c8-413d-8680-095d419cb2ee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78228e9b-c119-4b03-9c6e-0d206892f543", "sighting_of_ref": "indicator--a13b3b9f-715a-4701-aa56-af6dba0791b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12b105f0-e5fb-47b2-b93a-85fef3fc1b8f", "sighting_of_ref": "indicator--d6293b24-0d3a-4c1a-9951-8962f91c1b83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47a2ef22-6ed5-42c6-961b-816c98e63e55", "sighting_of_ref": "indicator--33af8ba0-da90-492a-9fda-9fcb73f238f9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f3a1ce3-244a-4e14-9c5f-1f019a8d751e", "sighting_of_ref": "indicator--55ee782c-d790-4ad9-b2ac-6872f8c937d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14d197ad-9f23-4a21-bd64-0e81f592bf06", "sighting_of_ref": "indicator--76ae47fc-1843-4c93-92a7-7f41a72fef7a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b910dfc-9abb-402c-96d8-b750d434db62", "sighting_of_ref": "indicator--0019466f-9d9c-40d1-94f0-ce855d52638e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--962ae60d-e897-472a-bb43-15e811777a82", "sighting_of_ref": "indicator--0546b7d4-1718-47f6-8f8b-a05fa289a954", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45b0693a-a56f-4a47-aa02-a7d0d81a6582", "sighting_of_ref": "indicator--01fbcf2f-05e0-4a6a-a5f6-68d33d19d829", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e889b1e-78ef-4ab2-a011-55220aeaf3c5", "sighting_of_ref": "indicator--df201f49-1256-40d5-9f7a-00f971cb8761", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fe5a88a-b615-4787-8161-b07f34764bb1", "sighting_of_ref": "indicator--71e00cb7-d0e4-4522-93f1-cee07b4c1445", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c838f434-f375-4ac0-bdf5-3a15b830f04b", "sighting_of_ref": "indicator--f0fb8151-038c-41ab-8304-94732d135fc1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf1acf55-c5cc-48ad-985c-a6fbb6a87976", "sighting_of_ref": "indicator--1c10f984-2cf9-4fd5-b5fb-0ccc0101e97e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b628547-fc1f-4156-8bc4-c462c4fb8696", "sighting_of_ref": "indicator--a3f6a01a-27af-41d9-923a-9349b875cc35", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ab917cf-5484-4e55-ba27-33339a6bcdcc", "sighting_of_ref": "indicator--01a8aa5f-95b5-4a57-a21a-e3a0d6a7aa1b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d5512f3-a549-499b-b2d9-efebe75c4282", "sighting_of_ref": "indicator--e2019259-4b80-40ab-8cf5-7432927d67ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4fe1825-2c47-4b11-9459-9af5e1bbbbf7", "sighting_of_ref": "indicator--b6f032d8-047d-4bc4-b7ea-d69ec28d9a71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dabc977d-2222-473d-a06c-438e11c2f964", "sighting_of_ref": "indicator--5623096d-df9b-4694-8885-a5b6b926c6a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa65beed-4935-4b6f-8c3e-7326f65568ea", "sighting_of_ref": "indicator--9b495ccb-6a63-4777-b8c9-8a7c663b76a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47bd56d6-a2dc-49ed-95b9-b3988df8c813", "sighting_of_ref": "indicator--43de214d-ffb1-4d7d-8911-cf8b75904f9e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af821135-7200-407e-9c10-35dcf8c97a6b", "sighting_of_ref": "indicator--bb5c8ef4-7814-4273-9c79-d9646aeb599c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--577abf53-db49-4c04-8700-15971416cf43", "sighting_of_ref": "indicator--66d84b55-96f1-4702-a775-900cea086aa2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de7b70c2-9e2e-4b6a-80e5-3d785dba5c83", "sighting_of_ref": "indicator--abc16421-149b-4ba9-922e-84dc99bee41a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f3722f7-759f-4302-8391-70596b0056bd", "sighting_of_ref": "indicator--9d56c820-ce14-4807-8a2f-a975c210950a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05b12fda-9fdf-4221-b8cd-32ac6a8f509e", "sighting_of_ref": "indicator--38038a61-ce1f-443f-af1a-9527924d69ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e513ecd1-7b17-4751-b57e-cc48430b02ba", "sighting_of_ref": "indicator--ebb3c657-79ea-45cf-832c-2707fc7f86a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01390706-fa1a-4b07-9998-4e080b20d52f", "sighting_of_ref": "indicator--d36e62d0-8c6c-4217-be0a-2afc5fa5903e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b904f9c5-3ab3-4129-8ae6-0f0ce6d42845", "sighting_of_ref": "indicator--cc4f3fc1-f56c-405b-9e19-30151de30197", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da1dd386-b6c8-4ddf-a0dc-1452b165b848", "sighting_of_ref": "indicator--cf755883-9547-44b5-9cdf-862fadbb435b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ace16b4-e54a-43de-a269-076aa90f171e", "sighting_of_ref": "indicator--4d301f14-a432-41bf-8290-2a07047928ec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff39d9a9-0389-4182-bd3d-6be4d860a3da", "sighting_of_ref": "indicator--a7df5457-bbb8-4f2e-967b-0e545b9c9a34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9bdfdb3-7ee3-4d38-a179-0ea643fbd702", "sighting_of_ref": "indicator--fd3c5d69-9eb8-4e4f-80dc-9e7e9b50a7c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41a17ba0-b78b-41d5-a6e1-a0a015bd290f", "sighting_of_ref": "indicator--7af16465-3e7e-47d7-8d49-ba6664ae5151", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21aa0ce8-a82e-4bdf-a653-e5c94e9fd217", "sighting_of_ref": "indicator--5367888b-21cc-4654-932c-d2589a4469e1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98c6ef9a-84b5-4b75-9cb2-2d3a259ac650", "sighting_of_ref": "indicator--92707fc2-887e-4e41-86e4-90aa9c10dd5b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a58228f-0018-4662-9c60-4eac79172cd7", "sighting_of_ref": "indicator--b77f1e6a-5c86-4522-b42e-2f8d472e5711", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f0f6942-f2b4-4d22-a53e-aef4549459e6", "sighting_of_ref": "indicator--88feafa1-7860-41b8-a148-f0434bbba335", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a91aa8b-0f4e-4e6f-a928-a29fef7cf629", "sighting_of_ref": "indicator--680a48f4-e5ec-4bee-a6e6-ebc785de34a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1ddb816-3380-4ec5-9293-1f67371b4cdb", "sighting_of_ref": "indicator--a512563b-9850-4d3a-b24d-ebfaf6964814", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e43eae90-32e6-44ef-bbb5-6e5e06f291d4", "sighting_of_ref": "indicator--7faf03d9-e5cc-4870-915e-a091c6dfcf17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2eebae4-aec1-4f2a-b94b-686681e8cd21", "sighting_of_ref": "indicator--bf51c73d-4f74-44d1-b996-a85d475d8709", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7448bdbe-b0be-4b39-878c-99c0b446169a", "sighting_of_ref": "indicator--0753fd38-884a-4d93-b7af-d233fdc3d482", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e925d54-24d3-4b53-a09e-3cc9d56fb52e", "sighting_of_ref": "indicator--bcc576b3-9b63-4455-b717-25c5d9bb88bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--459034c0-fad3-4079-b0ce-cd897a456294", "sighting_of_ref": "indicator--2f76f05e-2626-44cf-8c21-06b3886a47a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f007e4a3-fa89-4fc0-aa97-1272ca5499fd", "sighting_of_ref": "indicator--d041ae93-8294-4066-a40c-c2daac5f2c03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be087692-f429-4c92-a057-f205f8fc01c3", "sighting_of_ref": "indicator--ff0227fd-5f8c-496c-8688-425b3db3f15b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d66f6f76-540f-416c-a100-7069065d67a1", "sighting_of_ref": "indicator--2a7c6f5c-8f6d-4fce-9579-0356cd63a6a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b216195-f9c6-472d-bc7a-0d9dd4a7dfa6", "sighting_of_ref": "indicator--2e02c026-dfa0-4355-b108-1b1ab457c75a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2aebe10-0724-424e-adb1-4a7b9ff4e6b6", "sighting_of_ref": "indicator--b22afc7d-05ba-41d6-955a-62a0e4e783ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b54aaedb-37a2-465c-93c7-63ad8ec9820d", "sighting_of_ref": "indicator--055cb28d-b071-4549-8343-e5987d8a4e2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a32e0e5d-8e4c-4e71-8053-0243a2ae18b7", "sighting_of_ref": "indicator--d648cf33-4ab0-4397-aa50-50ab80f1d9ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bf194fb-fa66-4c0d-b5c9-83b9b5380001", "sighting_of_ref": "indicator--753b7fad-da7b-4467-95ed-894415f881e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42069165-8c7c-44e7-bf44-3486deca24f4", "sighting_of_ref": "indicator--e976f6bc-35ee-451f-83bd-7fdc18dce660", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a19814ab-616d-408a-b568-2dfeff417929", "sighting_of_ref": "indicator--bfb84536-c848-4ecb-99e2-dfc0b0494156", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--457b5701-e840-49dd-9e85-c592e0bab8ac", "sighting_of_ref": "indicator--cb527c57-1a45-4881-b4cf-9c7222266563", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adecfe60-fd8c-4a0e-b668-7a3eca312d22", "sighting_of_ref": "indicator--ef0aa436-e30e-4c7d-9b72-597aff51ba95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbdabe66-3995-49ab-9592-86b00ecf6832", "sighting_of_ref": "indicator--847e05ee-07f1-4c8a-8108-4619764c9fdc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b363cb63-8095-447d-9b68-b6b7b3181774", "sighting_of_ref": "indicator--2fe4049c-647c-4d43-a41b-ff82b3aa6b0b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c22f4eb-c3e6-41cd-8bb6-c409ef6ba5a0", "sighting_of_ref": "indicator--6f704e87-13ec-476e-b676-2e6e924aa7b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7a4a639-5f42-417f-8769-35d0e7f674a2", "sighting_of_ref": "indicator--e43bb4ff-7659-476f-b5e9-8ad956d87d29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d21242f6-bd0d-440e-a088-f8690da414b0", "sighting_of_ref": "indicator--10575f25-dc51-4c2f-a304-3b3a04ecbf04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4bd124d-8f68-4403-890d-32ce45fb59a6", "sighting_of_ref": "indicator--85711dc7-46a4-4fbb-a1de-34d399ba8fb7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cc1f093-702c-415f-b465-435a573d9c2f", "sighting_of_ref": "indicator--59c13e09-ee54-4db7-aa0f-fc69e067d45a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2134d37e-3ef8-4a81-9ce1-84a8b0bd4a4e", "sighting_of_ref": "indicator--37d1a7c3-4a82-45e6-876f-d051fc412ce5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dea5f7c-b42d-4b23-8cc1-d1540441548a", "sighting_of_ref": "indicator--c3d4d44b-ac4c-48b7-89fb-74589980e8b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d84734c-0a2f-482c-97f8-bbf0da961f6d", "sighting_of_ref": "indicator--14d4f00c-87f2-4526-9458-7751a1c5774a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68e7533c-2d27-429b-bfd1-4b793eb258ab", "sighting_of_ref": "indicator--2cd963f9-6807-4f11-8c0d-6ff3d8937cd4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ac2839c-4fcb-472a-a705-7b02e9ed0372", "sighting_of_ref": "indicator--fe0eda18-7fa4-4f71-b08c-1ba1a45904f2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ff4dc20-cd98-42e8-8e76-ed28afb7c9ad", "sighting_of_ref": "indicator--b567a608-4a24-49f3-b829-3228f5f3bf87", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--250033be-0f2a-4e9b-be24-f84e13ef8f87", "sighting_of_ref": "indicator--228caded-7e9e-4975-85e4-6682bf8e23e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48cfbc4d-eda8-4db7-a721-df5d24544e94", "sighting_of_ref": "indicator--6ab32c5f-b5b2-4365-9212-c2b9727f85dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--234efe0b-dd2c-4ee4-8060-bc19895970fd", "sighting_of_ref": "indicator--824c352d-ceee-40d7-8b18-dcc17ce43213", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6332c75a-9abf-44ba-9b87-c2a709401fbe", "sighting_of_ref": "indicator--c238dc56-ef63-4337-bf83-45fdaf517473", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f0a3370-1574-46eb-bb4c-a7e0f798e3f5", "sighting_of_ref": "indicator--b31c533e-0037-4999-be01-0deb37c8e60e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4b6a86e-be0a-40fa-b835-f7442a2ec6f8", "sighting_of_ref": "indicator--37217d0f-0afb-4746-9b10-f216035e2589", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35868e4b-1f68-4b82-a033-9206b7407429", "sighting_of_ref": "indicator--110fa753-df09-4675-be1c-1f65f576f115", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a273345e-c056-4399-9867-49a77981814f", "sighting_of_ref": "indicator--6a7c2207-f511-4e67-b98b-d6260281b41f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8f1161a-0091-4e73-9430-7aa027e863b1", "sighting_of_ref": "indicator--69e3ed1e-b68e-4d2f-b60c-c929e0bb3ad3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f6d8a7e-80f4-42ef-aceb-ca6885c65c68", "sighting_of_ref": "indicator--dabe32a8-238f-49b0-969b-54816d24c2c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5632132e-40e0-4ed4-9f74-ec15772d15e3", "sighting_of_ref": "indicator--e2253fe5-f25f-41ad-b314-d60fd2207b81", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68fe35d5-5b80-4b42-9e18-514dd021300c", "sighting_of_ref": "indicator--43dfd411-84ba-4600-85aa-2e29b7ba5aa4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91ea4138-ef3c-43a0-810f-55b6d035cd1f", "sighting_of_ref": "indicator--377871d7-0030-474d-891c-beb678543893", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--182ea1ac-0b77-4dbd-911d-11659b5f65b2", "sighting_of_ref": "indicator--cc319de2-c77d-4cf8-b02d-79cf2a35dae7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1be17fd9-4368-42df-a617-2363cbe97f9a", "sighting_of_ref": "indicator--3326a003-f948-4069-bfe9-95820462794a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c85b1a5-afbe-48d2-aa27-e99cc77eafd4", "sighting_of_ref": "indicator--6e384208-8336-447f-8bb7-5a54c81f604a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--860ad848-e6d6-4c2d-9869-d9fc01292fff", "sighting_of_ref": "indicator--3bdfc120-84e1-48c9-8da3-00aa50b3692d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--597600c1-376b-426b-9093-f72ea1456db3", "sighting_of_ref": "indicator--a8d5612e-f3bd-4862-937f-bb4bda51c780", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0de81ac-f7c0-4ec3-93f3-913492dba6cd", "sighting_of_ref": "indicator--4a8e79f3-37e9-4a3a-b766-49cdc2b40fe6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e50ceaa9-baf8-4b69-934d-3fb1b28e6e35", "sighting_of_ref": "indicator--906f8eca-0004-4d0e-a9d6-408f72ef89ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c2ee6f8-aec0-4782-a02d-b8cfbc9d69f9", "sighting_of_ref": "indicator--589b9ead-551a-4fb6-880d-2aecb84646ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eefbf37a-f1e8-4c0a-aec6-b2c36eeb091b", "sighting_of_ref": "indicator--13b09886-2e45-4a10-a200-9e2e60125e55", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71629ed8-de57-4a41-93c3-7a16c0246bd8", "sighting_of_ref": "indicator--d7385e8b-414e-4a67-b219-8f45a3cf7d54", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6b215b9-73ee-405d-844f-0f94283e6e5c", "sighting_of_ref": "indicator--9193dd68-6f28-4cd9-88fb-96bb5907d0b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bb557e7-59eb-4754-b34f-7629553a4a42", "sighting_of_ref": "indicator--c3af5cce-3315-45e7-8b02-66d5fb5c5f44", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b82a0a0-85a1-490f-8720-d9c782247412", "sighting_of_ref": "indicator--e8dd6688-9ac1-4acb-84a1-7f07150e6748", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec919d04-c08f-456e-abff-7081bc51c091", "sighting_of_ref": "indicator--8ac5c285-3059-409b-ac9d-316359c48ad3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d6e27af-912e-4251-be0f-93bf3e09332c", "sighting_of_ref": "indicator--6dd9da01-7757-424b-8bfd-58fcbd0d7450", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dc8ad20-c392-4f42-bca7-6ea9abccf57d", "sighting_of_ref": "indicator--c598a337-d5ff-4ed4-81ee-a1a399ae06b0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3e7cd0d-d554-479c-9989-eacd75a81f37", "sighting_of_ref": "indicator--3e0eca28-ff41-4727-9213-bb01a7c950ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed695a4c-ccaf-47cb-9c68-747173d38b4e", "sighting_of_ref": "indicator--63c9fd99-3a52-43bc-afa8-471e6af1ee3d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d55c8028-4706-4b4f-8e8f-2e7f680c2cad", "sighting_of_ref": "indicator--5febbb1c-735d-4427-b4fa-f3d52a33ffb7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--751f2df7-cdd7-4057-a4cc-701a0a5efe48", "sighting_of_ref": "indicator--92e0380f-f4d6-4b8f-b1f7-48e997d83278", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc7ebd8-1a26-4b56-a715-10d027918e33", "sighting_of_ref": "indicator--0b3c5031-4ee0-4cfb-81cd-6115ff099629", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbfa0182-bce4-41a8-ba3c-93b1400bece8", "sighting_of_ref": "indicator--c4f66fe8-7ed9-4581-a70a-319c6a373fb0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84528161-61dc-4118-87a9-31b9ca412d66", "sighting_of_ref": "indicator--469b6110-677b-4517-9e02-a6e00029127a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d869f722-7f54-4c1c-b651-0b104c4c9e3c", "sighting_of_ref": "indicator--650138d1-1dd8-4b0d-9347-f1a166d12e4f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b0e4a9a-f1c6-43cd-8dcf-fb07152b93c1", "sighting_of_ref": "indicator--1bd16678-be5d-44bd-8de4-0f07240dbacc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf44d78d-6a78-4a0f-9dd6-55f182635199", "sighting_of_ref": "indicator--2a3ba5b7-67cf-4503-b2fe-69610fc1bbce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c0c85a6-8c7b-410b-8aa9-10bf3abebe6a", "sighting_of_ref": "indicator--08752711-67f5-47a6-9932-43ddc6d21d02", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe8ea259-25c8-4f18-a0f5-221a3a0baabe", "sighting_of_ref": "indicator--b23ce3f5-339e-4771-a9b9-e0d558f1a2c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--968ef9f7-8741-46b7-ace8-78f8f4c880c0", "sighting_of_ref": "indicator--b5e754f5-a9b8-4ab8-b80d-de77f0b1be05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e27ef4fb-1361-4817-abe6-13150267bd76", "sighting_of_ref": "indicator--88734961-e7e3-49e4-b5ae-837b3c965bed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d7499d9-c0aa-4997-827e-a00bf215a1e9", "sighting_of_ref": "indicator--7e86d731-e822-4851-8237-848cf8cd6cd4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b6d5325-c1b2-4277-a6b7-35e6ae4f13ce", "sighting_of_ref": "indicator--7cebf8bb-692a-4b15-92d0-6acc862519bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e763095-e6d0-4a9e-ae74-b1b3221f7810", "sighting_of_ref": "indicator--2ecf6178-615a-410d-aae5-e6cefe115755", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5df693d-a2bc-4b0c-a215-c43f2b8ac81d", "sighting_of_ref": "indicator--3903bcfc-4c5f-4857-be35-2ff5c0c0d52a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfed7b3b-ee36-44cd-916f-4cb39c8c24ba", "sighting_of_ref": "indicator--ffb963eb-e839-40e9-ba56-d3ac8a15b79e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ab0014f-1b01-4b6f-8ccc-1cd4bd00a930", "sighting_of_ref": "indicator--6e89b66c-1aea-4dc5-96e2-bd2ee7bc03e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f95b88fc-507a-40a4-84ef-f2fd75e9a29f", "sighting_of_ref": "indicator--e835bd90-9f37-4e2e-a170-beeb9b62df8d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1184112d-04a8-447d-90ef-51db603da93f", "sighting_of_ref": "indicator--38cda3b2-ad47-4136-8127-338a98685537", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae0c2d78-695f-4414-9acc-50c30677305c", "sighting_of_ref": "indicator--923b5bfe-1719-49a1-b256-76a4afe94fd0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4cab31c-2e30-4c2e-9fec-ac34db567110", "sighting_of_ref": "indicator--11f04b1c-a575-4398-8614-c9d9a1cab84e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceca151d-3048-47b5-a5f7-94db27f084d2", "sighting_of_ref": "indicator--f3ed90af-c753-40d9-bbc7-a0fd3da22da2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8667b47b-288c-4050-98f1-27ccfbb990e9", "sighting_of_ref": "indicator--47666c6b-fafd-4c71-bcef-85e36bc08751", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b531de60-0290-49aa-a345-398376556620", "sighting_of_ref": "indicator--46b0a3dd-bea2-4d0a-aaaa-e34da32af0fc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0f985fd-f08c-435e-9e30-4a15070e938d", "sighting_of_ref": "indicator--2432bf21-2e94-4fd9-bd8f-3f800d2d8bb2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e66332fe-70f6-4499-8909-1b0648d07292", "sighting_of_ref": "indicator--23af2e08-fbee-4c14-9a45-d8b0c03022a3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--422f6a25-f307-4d11-bfe8-ecbb87c4a1ee", "sighting_of_ref": "indicator--fb8b533d-4c5e-44b2-a6fd-fac32d475b30", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40301d6e-6789-497a-a327-d5aaf6eee7d6", "sighting_of_ref": "indicator--69cebfd7-445e-4447-b971-e0e6b62f59f2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed48b1cf-64b7-41ee-980e-da36921c2ecc", "sighting_of_ref": "indicator--108a3103-ddf7-4231-b447-db908ad58b86", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06307de9-024d-44d5-9044-a9b92624faa9", "sighting_of_ref": "indicator--cc932f1b-04d2-409b-8e0b-0d9d7472c233", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4ad9bad-6574-4a9f-a8f1-8db4a0402414", "sighting_of_ref": "indicator--b49df34d-a6f9-4304-9641-879223739417", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--706f90ff-81da-448b-8d0e-36db08886f0a", "sighting_of_ref": "indicator--56b51a08-2b40-4791-afac-bbc457e84a1a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a00689f5-722a-4584-b419-302ab30d8688", "sighting_of_ref": "indicator--25f36c58-e33b-4fbc-8630-2c51bcd9693b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9af6638-44e4-407d-b2ce-c87e5b310ec3", "sighting_of_ref": "indicator--89afe07e-2431-4bcc-844c-3401119ec562", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f9c8b33-060b-4ac8-a166-88bb5f35413f", "sighting_of_ref": "indicator--939cd52c-a264-41c1-ab4b-406e28bc35be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb851666-f06f-4b29-8532-5e7ff1a3d046", "sighting_of_ref": "indicator--2cc88550-081d-403d-8a58-2f5deadeb5cb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--272e5fb2-d0cc-44f1-8bea-d126b8c5373f", "sighting_of_ref": "indicator--95be7baa-981b-4f84-998f-cf42430cfc9c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0db34fb-c813-4f80-b481-3d50f8551bb4", "sighting_of_ref": "indicator--3b0bcf94-3a24-4745-997c-b71ac3040572", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6680e455-6c8e-4dee-9903-16b77b9328ad", "sighting_of_ref": "indicator--8f57f90b-94e1-4c47-8d9f-1105768d72eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e7b7225-dd92-41a7-a42b-e15a02e63863", "sighting_of_ref": "indicator--0a9bd56c-d9a2-46af-8f49-02133ed6e843", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f48577a-b797-43bd-b2b7-e99e4d679bed", "sighting_of_ref": "indicator--579d6e88-a17c-4356-8b44-910557308bae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8e2ffb7-c2a2-453a-876f-85d98ef36acc", "sighting_of_ref": "indicator--b09638b1-c0f5-4d76-b12a-115c08daa548", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f21082df-ef27-469a-81dd-ff074f478aa8", "sighting_of_ref": "indicator--ccf72740-f48c-4542-ae1f-db7b8453fb53", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83a9410d-978d-4b43-9b62-c50a5a47f184", "sighting_of_ref": "indicator--8263098f-69c2-45e4-8e89-faf2d0b8af21", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c977e93-5640-4e55-b324-f1c234bf062c", "sighting_of_ref": "indicator--91dbeea3-fa7d-47d9-aedb-f3b1f36abfa2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--778bffc1-4241-4764-b19a-078b8735cf7e", "sighting_of_ref": "indicator--3eefcac2-4dcb-4fe7-8868-5d3004795afd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a35eed-33c0-4e15-8da2-40534b666cf4", "sighting_of_ref": "indicator--218910ed-6c5e-4337-b77e-679002e3d6be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--590772b1-b38b-438f-a994-88ba18d87905", "sighting_of_ref": "indicator--1dc85db4-593c-4fe6-bf4a-ce561c4fd135", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37720a36-ff85-4853-ae17-fa2d17c35e8a", "sighting_of_ref": "indicator--1481f977-603c-4818-bdbe-3611cddfdc15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a226f796-113d-4bd7-9925-c682764d934f", "sighting_of_ref": "indicator--7462af77-3131-4b2b-a685-4a49729f18f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a2c3e2f-9909-4de8-b3bf-8bba1f64629b", "sighting_of_ref": "indicator--4e4bdfc2-6558-4cb6-945a-50091786a318", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74243ae7-6713-42a7-9428-096ad0085d30", "sighting_of_ref": "indicator--385c72fd-2b32-45bb-a69d-a2ef2cf9444e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58220ccc-5f42-4f04-ba96-f9b8239b71ef", "sighting_of_ref": "indicator--e7fee3df-d9fd-40bb-850d-650c5044718e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f40ff733-018f-44c7-8155-f7dcfb7e30f4", "sighting_of_ref": "indicator--15118ed6-f7a2-4fcc-96ae-0979af34c0d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cbd3312-4c67-466d-94c7-9719fe35eaa7", "sighting_of_ref": "indicator--4e06890b-fee5-42bd-a4ae-63b281ebb264", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c6821b9-1afa-4623-9fbd-2b7aacceffcd", "sighting_of_ref": "indicator--d10cc391-520b-4438-b3b9-f3bbf30ee300", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc667016-7894-4f5d-9f04-3417f0364ea8", "sighting_of_ref": "indicator--e147e4e0-4eae-4209-9df8-a7ee2712d4ec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a484af81-ffa4-48ea-b8bd-37c635180924", "sighting_of_ref": "indicator--fe5f7947-efd3-46ce-b6be-ae62b2b27fc1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65ae62d8-81fb-466d-8ade-16978b8671e3", "sighting_of_ref": "indicator--233862ab-ab5b-4daa-ab0b-2418c97a0014", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d490cea1-fdef-4517-9b21-b95ef1c36f86", "sighting_of_ref": "indicator--df469365-827e-45a7-a1b2-92f63c0c4a26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a229a42-4e48-4dcd-98a3-7ce4b0902adc", "sighting_of_ref": "indicator--38bb9497-cdd3-439b-a550-c99b6278f9ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--254a1d09-6703-49b2-b055-ce979bae5226", "sighting_of_ref": "indicator--81d3bb2f-22e4-434f-a6ba-6c664dfe25e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb431ed1-ed8c-41f1-be2b-05eb436dd63c", "sighting_of_ref": "indicator--2fc1ef43-099f-4ad0-820c-3c0bf408f6c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a7439e2-aa10-42a6-9eec-148cda99bb1b", "sighting_of_ref": "indicator--af16ba2e-21e0-45a7-8db5-ca20ae82ced1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc36edbf-c81b-4a3d-976a-09242f2c3802", "sighting_of_ref": "indicator--9d210cc2-9fdd-43d5-8a3c-81ecb4cd79f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--077092ea-5e3b-4e35-ba4f-8d26873674a1", "sighting_of_ref": "indicator--2213fade-d7c8-4b86-bcb7-6f770b0f0900", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dbfb5ae-063a-4f65-8cd2-d4ec8b3dd754", "sighting_of_ref": "indicator--3475efbe-3764-422d-b635-74b684c2433e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9996b337-624b-4933-9b5b-0faee27d1c2e", "sighting_of_ref": "indicator--4f966191-da34-4271-8fd4-85cf8b8463c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f2c5437-cc99-4024-a960-aacef662bc57", "sighting_of_ref": "indicator--ef2394e9-1d0a-4b39-93ed-8ce52cb00737", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfbe0844-f144-4507-b6c2-e2b8fb5eabad", "sighting_of_ref": "indicator--2fa4df8c-1e2b-464c-8996-7a23827c187a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79f93413-471d-4292-a981-b53f0d0bea27", "sighting_of_ref": "indicator--9a8398fd-756b-4727-bfd9-c24556cb69c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aabdb998-9d7f-44b9-81e5-c1a77345b483", "sighting_of_ref": "indicator--bd36f114-54dd-46d2-bf3d-d6a93484e4cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6274dc6a-e70a-4abd-aa1a-fe8b70987870", "sighting_of_ref": "indicator--1267cb1c-c1be-4073-8c24-e39271ecc715", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac3e6ae8-2c69-4176-8445-a87d1f04af4b", "sighting_of_ref": "indicator--39ec7d2c-6108-4d29-a3ce-e129925bb396", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99b2afc8-994a-4a35-b9ee-31243b490e10", "sighting_of_ref": "indicator--2a2bfe11-94ba-4aed-ba6b-b0f0fdaf3b96", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a9c7cae-7aae-45bf-bb2c-69d6da2c09be", "sighting_of_ref": "indicator--e011c0d8-c255-497f-9de9-0a57a5df04b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c0902df-3e87-42f7-949a-57af3a14a3a5", "sighting_of_ref": "indicator--d708904b-0094-4e65-a557-b940e0f4a929", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86674bfb-6810-46d9-ab22-f86b29085415", "sighting_of_ref": "indicator--c727105e-9fb4-407c-ad62-0140239e1be4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--701277ff-51c6-409a-bb17-11d99d0f55d9", "sighting_of_ref": "indicator--62e32bfe-4c95-462d-b22f-43aadf1a7f12", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--761270d0-d335-4d00-b68f-9a58c9a4d98e", "sighting_of_ref": "indicator--b525e837-d53a-41ba-ae5f-6dcffcfb3d83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b6d788e-9e78-489f-875c-163e56ff81a6", "sighting_of_ref": "indicator--600ac1ba-d8e1-4104-9d64-178005b0592e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d14b69d-7948-4d2e-bfcb-5141d61b92a0", "sighting_of_ref": "indicator--4324a72e-4cbe-4964-bd25-86e6597aefdb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd1d3537-81ce-4c13-85e6-ae171e25d06e", "sighting_of_ref": "indicator--bc8a1c7b-f346-4b95-8b76-46429ff7d81e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--960f2b33-2d3a-4e59-bc95-cd5f05fe3788", "sighting_of_ref": "indicator--4c63e2c9-4035-4686-9c08-113e05fdd0a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fceb69f0-6d84-4342-b483-d8b72e9e2d5c", "sighting_of_ref": "indicator--2b95c8c4-a46f-43a0-b283-e5377ecea3b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c59c49-db34-4b3d-b0ed-9c864c1cb7c9", "sighting_of_ref": "indicator--fc70d760-7ad0-472d-a3d1-dee8827f5109", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9f6e813-d0d0-4887-976e-a2083884a0a4", "sighting_of_ref": "indicator--06da88db-ff14-41c8-a02b-e16d291ca4b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ba93d21-b929-4d94-a04f-a07050053806", "sighting_of_ref": "indicator--325bc272-7cb4-4b96-b442-3608135897e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d9333b0-da5e-444b-b280-0ed48ce6bd45", "sighting_of_ref": "indicator--be0c48f9-29d9-4200-be58-358ea49009d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b1f6cce-adc5-4c53-acc3-42107355ee46", "sighting_of_ref": "indicator--d6bfd32a-59a3-45ba-85db-a5843efb8a2d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eea3783-6c57-4613-8611-9e7e84f170fe", "sighting_of_ref": "indicator--c3a73d20-373c-4337-aa7f-5c0cbb228ee0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e44dad0-e950-4242-b5a3-071000f6bbf6", "sighting_of_ref": "indicator--75acf9d9-0d2c-434e-a427-0e8687edd55f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c60d5d6-8fc8-48e8-8983-a673599f80bd", "sighting_of_ref": "indicator--61ab7082-0578-4910-b4e6-d84c8d6667ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e05e96d4-1125-41b6-9356-70f985280193", "sighting_of_ref": "indicator--422b2394-2aef-4390-8611-fd2d610b4f3e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b81f51b0-c165-48e9-9bf1-17420aa73092", "sighting_of_ref": "indicator--42952854-e946-4c04-b62f-93cff94afcfa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae8915c1-1f0b-46ab-87d4-39b6d82e5264", "sighting_of_ref": "indicator--7c40e319-0ef5-4c21-bad4-2ba99dedd6df", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a4a4398-ade3-478b-b08a-e77289c2bb7c", "sighting_of_ref": "indicator--4f03bd7e-0ecc-49f1-b7b5-582fbbace294", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70d0021f-96a1-4988-a27b-9eff47704933", "sighting_of_ref": "indicator--64fb355f-acf4-4375-a9b3-e8aaf4376476", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87979f49-8372-421a-945a-ca46f521fecd", "sighting_of_ref": "indicator--0415a227-e9f6-43e7-a65d-998553e49d3d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97939b14-25f9-481b-ba0e-7f09bd54bdd7", "sighting_of_ref": "indicator--8cf2de7d-934e-46c5-97fc-04a8e5e913bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5951a61e-03d0-4efc-974b-fab9adec8a5f", "sighting_of_ref": "indicator--9a10e406-1ebc-4067-94c6-cf5191babdf5", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b7e02d3-d52f-4f25-8159-2f7e6edc3a48", "sighting_of_ref": "indicator--65b03642-f90d-4052-b640-174982463c26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce76d90d-e819-4fa4-9f1c-856f13c9548b", "sighting_of_ref": "indicator--65b03642-f90d-4052-b640-174982463c26", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ecacb93-d6a7-4a2e-aed0-214f3a5151b8", "sighting_of_ref": "indicator--6e460491-faee-4b84-8f29-ede51a616800", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16a19137-6995-475f-a574-0baaf93c4fb1", "sighting_of_ref": "indicator--d5456c0f-acff-4505-908e-b43440929e16", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aea82f1-1dfc-4fbd-845c-d50f4db503a5", "sighting_of_ref": "indicator--03e357d8-3f24-4525-b96a-6be940dbfea6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d03c028-0438-4db6-9804-973f2db8c3dc", "sighting_of_ref": "indicator--4103719e-cb9e-4c62-b196-fa92677d06ee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc98041f-b589-41c1-b302-687b22a296ab", "sighting_of_ref": "indicator--22d7be72-ba97-4b48-94a6-de600ef9dc96", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea685a7-f2a3-4438-8f31-6ca06f127146", "sighting_of_ref": "indicator--fe5657bf-d641-418f-bf5b-71d381b5337a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--836884de-fc90-4803-b129-c3d661014cae", "sighting_of_ref": "indicator--61ea615b-f928-41bd-ad23-b81fcd2f5f9c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f88d115-0ced-4cc9-bf88-98b96b37f6b3", "sighting_of_ref": "indicator--50a140dc-205b-4374-9439-f353e8f1c574", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caadfe78-2a46-46fe-9719-907da51ea443", "sighting_of_ref": "indicator--5ddf2e1c-521d-4b6f-9089-27a222059e30", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22f36282-a6d6-424d-8d93-10ed5b9eb77a", "sighting_of_ref": "indicator--4ec3a398-3c7d-480d-8266-c4ee7e4f4fd5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43464e70-13d8-462b-9e53-16392b3c0245", "sighting_of_ref": "indicator--d110060c-fc08-4ee1-a1df-ccec62dfd52f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed34f010-ebe7-4c7e-ab7e-c7c6e3e6ac77", "sighting_of_ref": "indicator--b9f9235d-2ef2-4093-b0fe-e2872207fd07", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10bb52b0-fcce-4e6a-b1a0-ea8c2326d9ff", "sighting_of_ref": "indicator--4fe3beb1-e259-437f-8a25-ace764be999b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3888b329-f1cb-45af-bb01-b16c20ff1e1c", "sighting_of_ref": "indicator--bf2147e4-26ed-42ff-bcd0-a10524268b1b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86326882-af11-41bb-ad22-aa867fd05234", "sighting_of_ref": "indicator--572ff091-e496-4566-acba-5e88f2f3a182", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38acd1a0-a048-4e4d-b1c1-dd13b4e6f7a9", "sighting_of_ref": "indicator--4575cce6-c6e4-45f4-94fb-0294c3ee3fc9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b703a74-2fa0-46ea-b220-6fd6aed8ba9d", "sighting_of_ref": "indicator--5b78d874-6c04-4ecc-a48c-db54f0e66f43", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc00d19f-986d-45e3-9e85-0b2ba8c404c1", "sighting_of_ref": "indicator--b296870f-4d89-4859-88d8-84fa085e3063", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b7c460a-0d22-408c-9e35-92711bd347a5", "sighting_of_ref": "indicator--dd21821d-bec4-44f2-8693-6b94c4ebbe21", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d2af903-306d-4a44-8ce0-a3bf1fbadebd", "sighting_of_ref": "indicator--99c540cb-ac78-4afe-bd30-97710d1c63d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f06071e-37ea-4d35-b7d1-6437f66c6ffc", "sighting_of_ref": "indicator--3955cfae-349e-44f8-aa8c-29d9f966fbe2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0fee35b-4ee9-43eb-b98c-4504d2e51b4d", "sighting_of_ref": "indicator--bbe5e2fb-6538-4de1-9e93-2d827c299d7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ed7b394-ac22-4a93-84c8-316039b815b8", "sighting_of_ref": "indicator--604bda63-22cd-4811-b809-4f9f688d5d13", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d26c2387-569a-4e2b-9a47-60f7b33da53f", "sighting_of_ref": "indicator--dc82b35d-5e33-46ee-86a7-12fd2ef9f5d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df519ee4-4917-4542-9b93-6679cb490ba8", "sighting_of_ref": "indicator--bb309618-2f53-4c9e-a7cb-b11b113cefe0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4495667-1384-4019-b5b0-91e1157f44ab", "sighting_of_ref": "indicator--ae14b51a-eeef-45c9-848c-25abde6cd349", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--defe9490-331b-49cb-86a1-965e77421a6c", "sighting_of_ref": "indicator--34b59046-e78b-4aff-8050-c6a13444825f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4afe5473-cbed-4d7a-b8e6-2c51c1503daf", "sighting_of_ref": "indicator--196004f1-c3f5-4a78-bfbe-e2c14aa3f80c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee22092d-b455-450e-82c8-9355b83b89aa", "sighting_of_ref": "indicator--257cee98-9e55-49bf-8f70-6397b42eb164", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf53d285-9163-4a26-8e97-fde5a16f2513", "sighting_of_ref": "indicator--7905cb33-ccaa-4656-929e-4f80ff234e4a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--365086a7-756e-4bb7-8dda-5f0a476b5010", "sighting_of_ref": "indicator--382a50c2-8acc-4075-8d67-0a9a6d2b10ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4cdadde-b18a-4b44-a285-c982fe97273b", "sighting_of_ref": "indicator--9434b938-8099-4211-b52b-e28e09b4f80a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98d72023-1829-4c04-8725-69e382af2ec3", "sighting_of_ref": "indicator--90b0bb01-a030-469a-aaaa-ce24e4606f03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d5f7665-0b80-417b-b4d8-365b0ea6b34d", "sighting_of_ref": "indicator--b9e79dee-0ce2-4467-832c-425e088f2cb9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--820c6810-a236-489a-821d-4e84bda6caf5", "sighting_of_ref": "indicator--4c12093d-7aca-4067-b90f-bb5fd2ba9ec7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc730b01-8671-484d-adf2-84e0dac605b1", "sighting_of_ref": "indicator--149c15f3-1178-42ec-86bc-c47581363370", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--638aea8c-014c-4d9f-9c95-45b5556b1b3f", "sighting_of_ref": "indicator--0ecf34c3-5d44-4cb1-ae24-9cce52b5f588", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--849fcdc4-7b7b-43b8-a42f-3aabd5179096", "sighting_of_ref": "indicator--512937fd-e0ad-441d-9753-31e14f9c1df3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cd8ca4c-9ae7-4a6c-827c-f0aa3d54eb0b", "sighting_of_ref": "indicator--45837ee4-37bd-4693-a120-31f933ff8a97", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5163d064-2c54-454a-b39b-aed337815807", "sighting_of_ref": "indicator--74ac6b78-a2b9-406b-baae-83e1007a19bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513e2dff-769c-4df4-858f-548f183856e7", "sighting_of_ref": "indicator--5ef04804-8bc4-4ae5-93a5-17eb30f722ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c06a1bc0-c114-438c-96da-611ba2fe0ae8", "sighting_of_ref": "indicator--49ba0c89-2a7f-447a-a4b9-8bb80059a1bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--866c61ab-cb1f-43ec-9234-6107e2d15484", "sighting_of_ref": "indicator--14e444d3-d822-4cbb-87e6-39907acd02ae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2debd8b9-12a6-434a-86db-5126671b440c", "sighting_of_ref": "indicator--ea97bf54-2024-4707-9998-04f855838697", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dfb9a46-0fbe-4445-b07b-5e900933b9f0", "sighting_of_ref": "indicator--9cff8515-428f-412a-9ad2-4929f4eb9e26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d803f48-f71f-4ab0-91dd-fe2764533cd6", "sighting_of_ref": "indicator--f9cb8e6c-037a-458a-8b1c-b8690101e47a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2276643-e0e4-42d4-83de-705539886dc0", "sighting_of_ref": "indicator--6ba3c228-a2f4-47f2-8a8a-481bf183c8b0", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3082afc8-cc43-47b5-bb21-902506552de6", "sighting_of_ref": "indicator--6faf630f-9815-4cf9-987a-c2d8d047cc8d", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa7b3849-ac2e-4fbe-9418-3fc389d205e2", "sighting_of_ref": "indicator--1db15b9b-a656-4b7d-9bb2-a08307a1e5aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--864942c4-1e59-4c8a-8d83-e98f7f8207c7", "sighting_of_ref": "indicator--482c677d-de83-4d51-89b1-ac8139a4a0a4", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--833c8bb0-b506-47fc-a3af-b80a9235294d", "sighting_of_ref": "indicator--821cff8b-14ab-4017-8181-e25eef268bcd", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f779342b-bb56-4521-abd2-ba56d395dcc4", "sighting_of_ref": "indicator--8a768d5d-99e4-4ace-86c8-6f1f0c6c22b2", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99aa3d5b-d095-4c90-850a-f61aaf08c5b1", "sighting_of_ref": "indicator--2e298fbc-35b3-453f-9bc8-6d2a2e0f4cd5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d12ad7d3-ca73-4807-9f29-9ecf7e1c9ca3", "sighting_of_ref": "indicator--f58502c8-04a8-43b6-86df-8ceee31d929e", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--304997a3-3da4-4a38-ae21-a5dc4a3c6af2", "sighting_of_ref": "indicator--49750bc9-5a86-4e1e-892a-1fdfc87868b3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dac08b8c-f503-4e5e-b4f5-46154e72fb22", "sighting_of_ref": "indicator--f0f5a4bb-9301-499d-8cf7-ed40b537ff17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d983235-defd-415e-b3d6-c51871510316", "sighting_of_ref": "indicator--3e19a214-47d6-477e-90ef-850b09439ab9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42a9dbc5-1361-42ab-9106-0f0354d77700", "sighting_of_ref": "indicator--4f954b62-1bb5-4ae8-b194-38cb178d6702", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7c30c80-423b-4af0-85e2-4954a91228e3", "sighting_of_ref": "indicator--91b7e5c1-de5a-47f2-a614-fac4f755cd66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--537434f1-056e-4562-9e84-830de20223b8", "sighting_of_ref": "indicator--68d4c0b4-c8a9-4eb2-be54-ba6ec75ebd5f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeb37e25-a876-4463-a582-58d30fffc341", "sighting_of_ref": "indicator--6ca2afef-87f4-4ea4-b769-61e9e7192742", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--633d5da7-8b99-4fb9-9126-f530a78b2419", "sighting_of_ref": "indicator--9a7b16ac-6b0a-4988-a9a4-af2022f918ae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b26798e2-9197-4b2f-aba6-d9b1fafacbcb", "sighting_of_ref": "indicator--d09fca7b-0323-49b8-8328-30a62e7cac2f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a12d89b7-e369-4d0d-85ee-bf0023c15f72", "sighting_of_ref": "indicator--0a44a55b-40d3-47b4-a9e8-0539efb7dcb2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07add4a8-40c7-4539-9015-a401f60430f3", "sighting_of_ref": "indicator--0baa4ead-ba7f-4527-998c-a582a73507fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13688bd5-c974-419a-b60e-a59883d6c796", "sighting_of_ref": "indicator--2a1ba108-1a50-42ec-926b-9ca0d7a125e0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9a945cb-9f4a-4918-aec4-99ed1e3ef664", "sighting_of_ref": "indicator--f11fa1cc-53b4-4a3c-89e1-88e3731ca08f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aa83eb4-9baf-4523-b402-d28df265aa53", "sighting_of_ref": "indicator--993a3099-570b-4d22-8cb8-4f98ace3c665", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--768c01ab-1a29-42bd-91b4-9912bd50f3b9", "sighting_of_ref": "indicator--7973f2d5-0b81-459e-98da-89dd4240db96", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eefc7b0-78ae-43b6-a151-1a19f451eb40", "sighting_of_ref": "indicator--77484691-0c93-496b-a1e8-2c0010f271b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d47fefd9-f783-4c76-958c-645df883fa9c", "sighting_of_ref": "indicator--9ee27a38-5ddd-4c36-9bc0-ef7f97649fc5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c82e06-3627-4dd1-a8a6-c86b10e02cb5", "sighting_of_ref": "indicator--f6122950-0b02-4040-8541-7fce9c989af9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d81503ae-5c83-4e98-9bab-45a1eb8348f6", "sighting_of_ref": "indicator--35c426fa-6477-43c0-9afb-246b63d73429", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--494954b5-e4bd-4789-b338-0a1c35a862ca", "sighting_of_ref": "indicator--95ebc9fa-7fce-437a-8f4f-d8bf48ea1d42", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d05ff6a7-5705-4be9-aef5-0cd105e067d1", "sighting_of_ref": "indicator--14194b16-6367-42b8-ad96-8e530d9b26e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89fd9daa-6d38-4711-8cb8-c1b332f4b57f", "sighting_of_ref": "indicator--b87c037b-f256-4ab4-a4a7-3ea1fa3589a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9793372-231b-4965-a587-24e1d080b663", "sighting_of_ref": "indicator--eafea9d4-c691-4312-bf41-e605255c5f5c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95c13478-fb2e-4ba3-ab6b-e9ebf7b48a07", "sighting_of_ref": "indicator--13c1a2f1-7cea-4cb4-82d2-f942453a31d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44aab46a-dad9-4c3e-8cd8-882089f9e528", "sighting_of_ref": "indicator--112f3e71-2cc5-488a-a365-56adcb43b159", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--356eda01-fb74-4272-b73e-aca819e486fd", "sighting_of_ref": "indicator--9a2ff9a8-e22b-49d7-bc4c-1b24a1e80a83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49f831ab-0b05-48c6-8653-07691f09efbe", "sighting_of_ref": "indicator--1ff43c14-60f3-4369-935f-645618ac1d92", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c30d9d7d-b043-4115-8850-b2c9e7b62832", "sighting_of_ref": "indicator--ede020ac-0e45-48ff-b81c-3e07b7c38b02", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9adc8534-c4ef-4854-bbfd-f76806dc4b63", "sighting_of_ref": "indicator--fb653bc2-e84e-4a16-9031-0c1a4b843731", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff0c1b9a-b913-4949-ad5c-f70d9103a1b4", "sighting_of_ref": "indicator--2ac36a11-453b-4e83-84e9-32123c5c8838", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0e5e959-3118-4eb3-8136-c54e82bd44fe", "sighting_of_ref": "indicator--66fe3682-e8b3-41cd-a148-1d26d65c1a17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25b8a660-9507-4d7e-a137-c281176ac274", "sighting_of_ref": "indicator--4eab45e0-57f9-4aef-a9ef-8237e384b82c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0da55589-6b58-409c-8ec1-1139670ed7c2", "sighting_of_ref": "indicator--f3f06152-d8e6-400a-8956-0fb4dcc2be28", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c373c8c4-02cc-43be-bdac-1b7ca1784ade", "sighting_of_ref": "indicator--b7337855-1d6b-445f-a569-c4dd786229ad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6493a08-5fc1-42bc-b440-08c136ccc3d7", "sighting_of_ref": "indicator--a236d970-2003-4026-8291-5f46243a24be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--563e87cf-91d1-4a10-bd41-a1fc6041bda9", "sighting_of_ref": "indicator--705e7b7c-b0ea-4d99-b429-7cb4ce448a65", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bad3fe6-20a0-4ef0-abf1-616819dacdd8", "sighting_of_ref": "indicator--371f73b3-a95c-4195-8c49-7cf592be213e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28bda81e-fbd2-4c9d-b241-7eea78d0434e", "sighting_of_ref": "indicator--efe3ac4f-4a59-4244-8755-c02e117a1798", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d451240e-7044-40da-9ad0-b5eaba4188ff", "sighting_of_ref": "indicator--5d25a27a-945e-466d-b226-18cecfb9424c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55705c54-66fc-439c-9189-de4389cec158", "sighting_of_ref": "indicator--4812ff73-81c0-4690-b420-fd903fed6499", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5af47ec-debe-47b4-8eb7-cbd1920c0637", "sighting_of_ref": "indicator--867d8383-41e5-4c70-8fb8-b0f8aab1c655", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2d7d2e5-b577-4c34-ac9c-90428e486ca4", "sighting_of_ref": "indicator--4f1e49b8-0553-4e08-b90e-7865ec30a6ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7de52bf4-5ac2-4d9e-a84b-e018edd3de2f", "sighting_of_ref": "indicator--1e31b52a-9dca-4bf3-955c-c362d8745a42", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35c95047-3eb3-411b-93ac-9b07c71004da", "sighting_of_ref": "indicator--71cbb122-f3f8-4982-910f-eaaf0bda4c23", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b97cef06-5d2e-4cc6-9bc8-76aab1a1bfac", "sighting_of_ref": "indicator--598d355e-3ca1-4732-a62e-6778cf04079d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d745f787-9bc4-4269-9aa5-0c8f37649b45", "sighting_of_ref": "indicator--b1246a9d-2263-407e-a78b-7b0c908168e8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bde90393-be6f-49c3-bde3-9844b9d76910", "sighting_of_ref": "indicator--a90559ac-9c75-40d6-b8d1-50702d0ce5b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cceb24f8-69ae-4fd5-adb0-7452f460f356", "sighting_of_ref": "indicator--35044278-78e8-4f61-8776-e98868d30203", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a1e8835-2dc1-4cff-a2d5-1fef551468aa", "sighting_of_ref": "indicator--f1b42ea3-04b7-470e-ac1f-9dada6d344bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bac951ce-6605-40f1-bf2c-5c586a05ae1e", "sighting_of_ref": "indicator--b9283af7-10a5-4862-a872-7b2936032aec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d9a12b2-870e-4f8f-8dc2-6f327b9a62fb", "sighting_of_ref": "indicator--246c8017-ba1c-4bf3-abf6-65d794f0e32d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60dc3302-a49d-466b-8a6d-89cc83d39e92", "sighting_of_ref": "indicator--a071d886-a6d6-4a6e-9dd7-098f15614ff6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25f09c0c-426a-4b84-82cc-3c6f538f0864", "sighting_of_ref": "indicator--abff7c83-39e2-4338-9725-3ed2cd542a28", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647bac88-c0be-4acf-9f23-8ef4ce4c8c49", "sighting_of_ref": "indicator--1ad4071a-1d38-402b-942b-1f7a9f990625", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0af99e3a-3d90-41fa-827f-594cba83074b", "sighting_of_ref": "indicator--8998ca4b-67e9-498f-a8ca-1bc7e02412bc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--697a0948-d0a4-4f29-8065-ec114a47a242", "sighting_of_ref": "indicator--da15afd1-5805-4eae-a9e8-b09101e8fb98", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c39daee3-a06d-4321-81ab-cfde8b46c44f", "sighting_of_ref": "indicator--70a756dd-cbca-4a40-868c-db3e374f359e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5afbbd83-2aa2-4fbc-ac9f-777b1b6adb4c", "sighting_of_ref": "indicator--47f4474a-8620-48e5-8cb4-3e0d7c18f00e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a3960b2-ba16-40db-b46a-23eae830cd6b", "sighting_of_ref": "indicator--7d6cbfe3-66db-4bfb-9ba1-2270f6b6e2e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b8048d6-85cb-48a4-a034-5d68ba81885f", "sighting_of_ref": "indicator--bfd8cdbe-b7b2-47e2-8978-c419b3a28b3d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--180db3d2-39fd-4f44-b4cc-12228ddfeb4b", "sighting_of_ref": "indicator--7d6189d5-a587-4530-b99d-a7b88a4c860a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd9139b-4275-4e47-ad7f-4f5f89eed3e3", "sighting_of_ref": "indicator--945eb530-cba4-48a1-9ea8-6515885395c3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38f0ab01-03be-4c80-aa7e-445ba1f504e6", "sighting_of_ref": "indicator--4db7aa9d-58cb-4bb3-8150-cabd2841164a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d23eca-ef47-4b9f-9fab-1ed6e531148f", "sighting_of_ref": "indicator--7d9f7797-e19f-4ab7-a603-18bb7e8c685a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85987106-4236-40e5-a34d-e25c66da0e5b", "sighting_of_ref": "indicator--41345679-3edf-4acd-9f08-6de128c0319b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3796335f-5990-4c5a-a088-0cd2bcdf2c63", "sighting_of_ref": "indicator--04870fca-2117-4701-bd1d-690ada2c323b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dda412ef-9236-4a99-8a7b-a911321cabdc", "sighting_of_ref": "indicator--b9e2b26c-4cf1-4b2f-9217-c7c94bb78e54", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1784d7e0-2e32-43e4-bf54-0c8f4263d02a", "sighting_of_ref": "indicator--1e1b4738-a7c2-49e4-8dab-9230e3357123", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc48d52-3e7e-48f9-b0da-1c21bf3db207", "sighting_of_ref": "indicator--0535945c-388a-4dce-a4d2-a13c0d5ca672", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3f1ae67-2fcf-46bd-8a26-13fb1b74afce", "sighting_of_ref": "indicator--cd47da18-d1a4-4d20-b840-a8e00401c436", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b2676c3-21d8-4535-b3d2-b49efef5311e", "sighting_of_ref": "indicator--3100b787-b6e0-496d-8728-f20528ea8687", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c7d3d2d-b5cb-425a-92a8-c2db6b4302ee", "sighting_of_ref": "indicator--8bdee152-b05e-4c15-a87a-ea7d83802843", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0b69031-b4f7-434c-a9d2-63172ca6b104", "sighting_of_ref": "indicator--41d361b8-46de-4214-9fac-9ed7da0a0fcd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--399ba29c-c52a-4712-9a1d-fc4b5e55e297", "sighting_of_ref": "indicator--cdf13cab-938a-409b-8fea-1ee5002206d6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07c8f336-66e7-4f18-8447-45ce4874d4d3", "sighting_of_ref": "indicator--ac888e55-62f6-4595-a0d2-e3718885e8fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebd4f620-32ac-4944-abdd-71ae6e0da990", "sighting_of_ref": "indicator--a76f4289-7e79-4f42-849f-bb32a6ce9dfa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d001eb18-c2ee-4980-9d9e-3f02fae8be6e", "sighting_of_ref": "indicator--a66c3285-accb-4d65-8295-d115cf47a3cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aa85307-3099-497e-a31b-903e3cb3e5ac", "sighting_of_ref": "indicator--e31ed053-2a06-440b-a927-c336c1ed64af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7e86540-6fce-43ed-9d1b-75bec1e5c999", "sighting_of_ref": "indicator--4f673968-8530-4b74-92e8-c484129265e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4df47b45-aba4-4427-a555-6870129b5bb5", "sighting_of_ref": "indicator--38716a06-b404-4355-9298-483cf29271f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e8283c0-3c1d-4a36-abae-f65e6d3e972b", "sighting_of_ref": "indicator--24f9f3ec-d619-4317-a7a5-dbf6965d917a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfec835d-794a-4211-ac9f-c77c98be4b16", "sighting_of_ref": "indicator--1b348f20-7615-464e-a031-a73f69dccfd1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0369d0c9-998c-4a07-b095-0bb0b0384dcb", "sighting_of_ref": "indicator--8b3881e5-e27a-4afc-908f-e047be67443b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b4113ca-8341-4188-8539-739cd0394dee", "sighting_of_ref": "indicator--81bdd17a-66d3-45db-b4a6-48d46dfe8094", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2233e4c5-007f-4e87-8c96-c24a5e34e160", "sighting_of_ref": "indicator--00dc5638-2a67-445b-bd20-360ae3f097a7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aa22dbf-f2e8-4282-adfb-c63b1b8db79f", "sighting_of_ref": "indicator--82cda69e-c229-46c4-b3da-4cfcd019fa32", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bdbaa38-64b2-4833-b3eb-53da86321092", "sighting_of_ref": "indicator--6f087f96-993c-49ad-b51e-9c80a9a6c103", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c3aeca8-3870-4b7e-b18e-95be6c37e324", "sighting_of_ref": "indicator--90c7c966-6f9a-46fa-aceb-98b628faccc4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21489943-d564-47ba-a688-d19373c6ef61", "sighting_of_ref": "indicator--7fa570cb-66f5-4a3e-9563-c23f8c021e2c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d8ca6f0-98eb-48a9-b98b-b86b3b5707f2", "sighting_of_ref": "indicator--22996d9c-93e4-43eb-886b-20f9ee79de70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ebd3856-87f8-4c34-a651-4b12d4d98eba", "sighting_of_ref": "indicator--9f5c2b6c-6bb0-4b98-abdc-eafe21c094de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2dd3801-7338-42ae-b062-bf8be320b7aa", "sighting_of_ref": "indicator--4a169ded-110b-4829-88a4-eb1532277d78", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4410529b-25c0-4fcf-b3c7-ade356f6bc0f", "sighting_of_ref": "indicator--410a1eee-75bd-483b-bcc4-5d2e26345bc1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9c74cbb-cca8-4e46-bc19-8fc81b7eae8d", "sighting_of_ref": "indicator--c6bd8640-847a-4096-a31a-26ca04076cf4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cf01185-9f1e-48fd-b2e9-5de2ac877751", "sighting_of_ref": "indicator--f3be9b03-ff60-446b-affb-dbc75838bf11", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58a511c4-cfa3-4c29-95a2-0a0a4fe7a23b", "sighting_of_ref": "indicator--68d5f861-cc56-41b1-b2e4-f5302966a224", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9296a820-51cf-4d33-aac7-8493cb03642d", "sighting_of_ref": "indicator--8006b556-22cc-457c-ac1d-ae2136543f9f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2e42dd0-1525-492e-a7ca-72cf26f5fad4", "sighting_of_ref": "indicator--c07ea66f-0471-43a3-aaea-edb445bf5b4d", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42f36d0d-3d34-4e18-bfa0-c7ae1775a8b9", "sighting_of_ref": "indicator--77d2d4f2-9619-4bba-8b75-fb486a305529", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edeec098-27e7-4db6-8b8b-af1c95db19c3", "sighting_of_ref": "indicator--2b390b83-8640-423f-bd5b-501ab99f0ad3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--158fb796-8ac1-49ac-a10d-f7a1e07ed40b", "sighting_of_ref": "indicator--d87aba30-f839-4ac8-bc7b-286f816ee605", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a88cc28-31aa-4049-a36e-21ff6df64a0e", "sighting_of_ref": "indicator--12549516-955d-4049-a5e3-eb213568f3aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60e5dc87-90ef-4763-ab1b-6caab96ee13e", "sighting_of_ref": "indicator--34067038-85b5-4290-bdea-50b30bd55d19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--632887b6-520d-46a1-8f23-2d37f1f9d184", "sighting_of_ref": "indicator--254f8ad5-3c01-4adf-9c03-c605e6ddfdfc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b944b9de-fa8c-4db1-8f41-51366bcb46bf", "sighting_of_ref": "indicator--4d9612d0-f37d-42de-b7b7-8494ea3aa4d6", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f06e8154-371e-4685-8bb4-dec7bbb2b96b", "sighting_of_ref": "indicator--5277a32d-f5d6-423a-975a-c9913ced195d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f122307-5219-4fc0-958f-a56074287950", "sighting_of_ref": "indicator--103ba07c-60df-4e5c-9d46-83b808a15f49", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a55a140-b65e-44e5-9e1c-fdb559c51265", "sighting_of_ref": "indicator--7c2550af-dc97-4158-af0c-b0baf193fd27", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--694c9a14-d355-40d1-85e8-3b1fad7bd721", "sighting_of_ref": "indicator--40c5553e-1eab-4b6c-b834-6c05070442ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0dd2ccd-7f1a-4f1e-9374-2bd1a99f9297", "sighting_of_ref": "indicator--82b05e8f-dcae-4d08-bcc1-7d77bf4971f6", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29006598-c0be-484e-a098-4fd1a0c69b41", "sighting_of_ref": "indicator--06d30892-d6f4-40a1-adab-549bb30157a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56328cbb-e485-4361-b7d5-7ec97945bbbf", "sighting_of_ref": "indicator--7c547f14-f2b0-4e19-9bc5-2d4a0b77f277", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b1b4ae-454b-4264-a78e-3f2e85e9613a", "sighting_of_ref": "indicator--7c547f14-f2b0-4e19-9bc5-2d4a0b77f277", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aa23b87-bd7b-4227-9af7-be00d37b163e", "sighting_of_ref": "indicator--f2ee5db7-5f14-43b5-8049-a13cac703477", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63662d34-9772-4708-9011-e3424572f4da", "sighting_of_ref": "indicator--90a1d79b-b32d-4516-9398-c9b70b80beaf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f99c6202-5c7b-4045-b910-de1451d7e0fc", "sighting_of_ref": "indicator--11fd5bcf-8055-460a-96a8-96d707f87722", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c10e3f83-e41b-4c39-b526-a73d404f6816", "sighting_of_ref": "indicator--e65c1a50-4860-4de2-8a4f-6f22968a27ca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--919eb624-df77-4778-8bd5-06eedbd5bb40", "sighting_of_ref": "indicator--171050c3-a60b-41e8-bce2-cb31cea533b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fde4f1eb-b933-471c-813d-09aeb7582af8", "sighting_of_ref": "indicator--1306e4da-b091-4567-93bd-a8eda732e21f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c292134-826b-4d42-b7ed-278ae75b0789", "sighting_of_ref": "indicator--706d8c45-74c3-4321-8bcb-d2ce0b1e50b0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6284e5d7-d687-4a11-a5c3-179f1e11d8a8", "sighting_of_ref": "indicator--426e9a63-f154-47fd-bb01-dc8a0664db12", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e26cbc8-1db7-4373-8407-e57f2ee50f13", "sighting_of_ref": "indicator--eb309564-dbb0-4d52-89ab-4403339b66a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--649b349f-c73e-444a-9ea9-8be12ff251db", "sighting_of_ref": "indicator--e7a318d2-dcc3-4bad-b8b7-f6910efb9611", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1968f397-fbe6-4098-b353-50a996c1e6fa", "sighting_of_ref": "indicator--f205b68d-9a22-4d9d-9202-59f36d00374d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7dc1f2e-2af5-4fab-93e8-1969d31af8f8", "sighting_of_ref": "indicator--f07560c8-6ef0-4d42-aa3d-f80df9f4b3a5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e82b3dd-1318-4d14-a6e7-fc6afdbccd29", "sighting_of_ref": "indicator--dfb6ba7f-9128-4d72-8590-7628ea80d307", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d449af5b-50d8-49c7-9a7e-1e60798342d5", "sighting_of_ref": "indicator--0fae791c-2293-43f6-9516-e1363948d8ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c63f300e-8ada-4cf1-8254-2bffa1685351", "sighting_of_ref": "indicator--9e9ea913-f74d-4b63-9948-449135f61e48", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--326991e5-3385-4a83-9747-8de8de91c426", "sighting_of_ref": "indicator--aec13a27-fccf-462a-a44c-97dcc3c83ea7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--951997b9-4757-49c0-98c5-3d380317290d", "sighting_of_ref": "indicator--9378ce4b-e99c-4407-ad5f-3c34669b8e33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d1fef4e-ed85-4ba3-80ec-88ddda6ba450", "sighting_of_ref": "indicator--b697be85-635b-4d1f-8b45-7f5f7bea0439", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f4ec523-f660-41e5-8ecb-8ee75e25e904", "sighting_of_ref": "indicator--f2718003-60c6-4179-b91d-bd806dfb2fa4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a5420c5-1c42-4c7d-ab94-8a1004305525", "sighting_of_ref": "indicator--7a23df92-64f9-498f-8cd7-c0897502376a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ca53990-9d93-4e43-8f87-09bf1c3fc3f4", "sighting_of_ref": "indicator--875488cf-b131-463a-9b3c-203f0250739d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15a46a1f-57a3-4378-bac7-55264da91223", "sighting_of_ref": "indicator--bf4a300d-22c0-4133-8b57-1463a9d52310", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b8a56c3-4039-4c17-8caa-5c185881f9b1", "sighting_of_ref": "indicator--b5f8fdac-3ad3-4791-ba2d-a6ffaec6f198", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6905abe-8ff8-4908-a8a1-a5a5a41af4eb", "sighting_of_ref": "indicator--67787911-a9e3-4fc1-b252-7084a0c4bc52", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2903e85a-4f30-4f34-a8e6-6d516bef6455", "sighting_of_ref": "indicator--3314f63f-2734-4468-b98d-d5eacf91da28", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdecfbf2-1049-4c0b-80f6-cf319018fe03", "sighting_of_ref": "indicator--3246f1b7-de59-47d3-a176-bef73f667ddb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edd0fa57-9365-4cae-af29-b1d6eb8cbefe", "sighting_of_ref": "indicator--8ba152b2-d761-4d50-a90e-51b794a6f32b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--492265c5-0d23-459c-a0a1-01fddbd89b92", "sighting_of_ref": "indicator--3507b3f6-9024-4818-b9fd-cebd84c42120", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--720ef06e-27e5-4be1-9c7c-de9d2c493eb1", "sighting_of_ref": "indicator--16031125-ad4e-44e1-b233-868781948a9b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00a2cbb1-2058-468f-a672-805b999935f2", "sighting_of_ref": "indicator--4e0cdc5c-fd00-4ad5-bbb0-e0fb3d91e183", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f44ddda4-a0d3-4f8b-be39-3cc91cec3c7d", "sighting_of_ref": "indicator--1680335f-6fb4-47b0-8c30-e622d937c68e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87fb7563-83cf-478d-b14d-87fc52709401", "sighting_of_ref": "indicator--2c0040b1-2dde-4cc7-ac5c-e5ad128c2a9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de7e29bc-bd1d-4fcb-9f2c-e9ad34dfad86", "sighting_of_ref": "indicator--f9938925-b28c-46b9-a520-cd4a8a8263ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c63603-b91b-4fc7-9469-3ebff1dfe0c2", "sighting_of_ref": "indicator--a6435035-5e27-466e-bd89-8e8edee48686", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5709b164-c4e2-4d7a-92cd-fd2dd893518d", "sighting_of_ref": "indicator--ac5a7a29-e2d4-4b27-b299-c5466c14d5e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9901c745-4d4e-4555-8ab3-6364705412bd", "sighting_of_ref": "indicator--726fbcd0-a72d-4974-98cf-03f470452975", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e992655-3cc6-47a1-8352-ad840a8cfd36", "sighting_of_ref": "indicator--5d03be4b-9279-4ba6-a4ea-788f412ae512", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41c501c6-0ac4-4664-8956-c9e6d014cecc", "sighting_of_ref": "indicator--44013d5d-9f0f-4421-a341-63b0f9584968", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a13f3b6c-911d-4fc9-a38c-adef89ecbb4a", "sighting_of_ref": "indicator--46614ef0-08dc-4e2d-91a0-1536a48c7d33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae735d52-66a0-4258-ae1c-c532a48a0885", "sighting_of_ref": "indicator--8838922c-92e1-4536-83b1-4bc166198a34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73ba5ad7-19fd-407d-93fe-daf65d07ee46", "sighting_of_ref": "indicator--72263ea9-60d4-4931-a4d4-55866b6bdb6a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deed7e8c-a05d-46a2-90ee-5b9e918e1538", "sighting_of_ref": "indicator--e31b5ab0-65bc-41f4-816b-80a15ee27310", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbf65754-8e1d-49c1-826a-a3da84446ff7", "sighting_of_ref": "indicator--4cdf3f88-1757-48de-9c61-2dd15e8fe65c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfb82375-02cb-4bd9-9fa5-71cff9653fcf", "sighting_of_ref": "indicator--ea002e96-3abf-4cf1-8e23-dfd7282fe629", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61a96742-8527-4789-b844-598b367ac022", "sighting_of_ref": "indicator--2e4896ea-23f6-4292-b573-4559cb3a99ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a2d327a-8618-4c75-bf91-4e26da7273a5", "sighting_of_ref": "indicator--b9e8ed6c-c827-48f4-8d3c-620a6dbfbc1f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7520972-547d-4774-8d64-49a33f053f6a", "sighting_of_ref": "indicator--4ba8266d-64d1-48bb-8d9c-7231ea371c66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54b8f357-4a2a-43ba-81a2-4ce7b79bb5f6", "sighting_of_ref": "indicator--efc702a3-843d-468f-8bf7-1c7fadec7b22", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9070c361-af25-4ae0-8c4d-5120c16a46d1", "sighting_of_ref": "indicator--0b997b1a-3332-481a-ac8b-627db735b731", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23a3eb5a-8fd4-47f7-b47b-9ee82b19665b", "sighting_of_ref": "indicator--89b9f2f6-dfdc-48f3-8575-e528bb159e7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a043857f-ee34-4b14-800d-0fca80a52ebc", "sighting_of_ref": "indicator--12de30d3-0744-4a9c-8486-d93dfd77d466", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8adb9e27-ff01-4d3c-a15c-05905efd17c4", "sighting_of_ref": "indicator--4d5da108-6991-443b-99b8-4ec43ed76615", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--013b9566-a0eb-4985-868b-0c88dde92540", "sighting_of_ref": "indicator--3981bc3b-130f-459e-81f1-4eff74edcb32", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a1e2958-431e-4590-bb8d-4ce63e19706a", "sighting_of_ref": "indicator--cbcc58cf-fe36-471f-bdb5-89c2b4560505", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1be997e9-0927-45ab-8bd1-6667a41996ca", "sighting_of_ref": "indicator--a09a38c7-d02c-4039-b826-91e5189ad128", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99e0037e-5b13-486e-a49a-db359be1e955", "sighting_of_ref": "indicator--711dbe0f-e51c-485a-a484-de82c99b581a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--048696de-b3f8-4486-b4ac-e1e6b456a716", "sighting_of_ref": "indicator--fa6414ca-6172-4570-9b69-78815e2e966d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67bfbd5a-b76d-4998-84ba-2da24d47cf9b", "sighting_of_ref": "indicator--603525fa-d128-4f20-a653-b8f06655cea5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb5a41be-1bc8-4b57-be01-26a55e369cd4", "sighting_of_ref": "indicator--3adccce1-facc-430f-ab2a-6972182948db", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c3536a-40f5-4e71-9c4c-dc7f83934562", "sighting_of_ref": "indicator--f957790a-0348-45e2-8e18-cfeb95f70e2e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--251a6830-9152-474c-993f-2548dfc208ef", "sighting_of_ref": "indicator--333764fa-37e1-4dee-88da-ba5567c37946", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6f6e556-8a53-49a7-bad3-43db9e91f66a", "sighting_of_ref": "indicator--c1bd3b91-f36d-4ba9-a70c-2d50f9df5512", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9efb604-966b-488c-bf09-2ef325ecbea9", "sighting_of_ref": "indicator--9519e8d2-7e53-4d2e-b8fc-a1c094528426", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d7ddd89-af2a-4d39-b2a8-a92984d4c291", "sighting_of_ref": "indicator--378a3ac2-ad42-4fd4-b145-cb06b1637885", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--005d993f-8485-4166-8676-7539c2c8bf94", "sighting_of_ref": "indicator--af9ab249-0c0a-42c5-8fd0-842c0e3434b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df52b192-a1b1-4b0c-9428-afb9a2387074", "sighting_of_ref": "indicator--31141320-fbdc-49f9-b35b-4a967dc4ffb0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--049def48-7c26-443f-a145-3c91b4e09944", "sighting_of_ref": "indicator--89c4ffc7-22a8-4f2b-9ccd-ec7d37760a5a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae0535d4-8c0e-4b96-89c0-25134253eaae", "sighting_of_ref": "indicator--6e1981f2-3476-4249-b9da-f75a3c472a44", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61af37c5-9028-4f46-ba6d-eb03867d14ba", "sighting_of_ref": "indicator--c433a025-3a43-4cc3-951b-813a2c0f5334", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65fb4192-6dc3-47e8-bb65-6a053977d01b", "sighting_of_ref": "indicator--184315e9-8149-47b4-8fc8-b462d43542f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce5f8fc3-2d54-4f8f-add0-07d9d5148ffe", "sighting_of_ref": "indicator--a18ed007-3440-418f-b8b9-a46dbbb787b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35fb23b3-bf73-481b-b607-4b518c1450f2", "sighting_of_ref": "indicator--9f441721-dfcc-4e73-96fc-9b72fcf5422a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6b71e58-f29e-4d91-85d6-f9af4af4b53d", "sighting_of_ref": "indicator--51dfcb08-0c36-41cc-8ff4-fb720c0a698e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01fd36e0-2ed4-42c6-8a6f-5a467a4f166e", "sighting_of_ref": "indicator--8c766a91-0695-4b2a-a390-c890741287ce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05123476-39d8-4b5f-92ba-eacd2fcc16ff", "sighting_of_ref": "indicator--9a2ca3d7-c9d5-4f86-a44e-d13411b32466", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cf4dbde-612c-4ea3-99a6-5bc7f584fdc2", "sighting_of_ref": "indicator--c327c2b2-d734-4e8f-986f-9e0ccaabd2ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d5b69e4-36c4-4d0b-9049-c1ad78f1c7f8", "sighting_of_ref": "indicator--d2469f16-d5ee-4636-a1d5-c5de15077c0c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcbc7997-fe99-463d-8b93-57a69be09dff", "sighting_of_ref": "indicator--95f92fa0-af6f-439b-95c6-f09171a1741d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43b4c3c8-d3e0-412d-9041-6347a7d29c91", "sighting_of_ref": "indicator--2ebbe5d8-173c-42d0-8dcf-a1f979129195", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0681660-73bf-48d6-93b6-abce5c778bea", "sighting_of_ref": "indicator--758b511e-2750-4c0f-af5f-5aa973f345a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bf7bc9d-60a2-4882-b322-c5958e0a83c1", "sighting_of_ref": "indicator--20ee6028-caee-4e57-ae1f-8e2c9904f9a5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--839ac1aa-0625-4677-80c2-6a2fc1b5a593", "sighting_of_ref": "indicator--85ffb749-f319-4e1d-8350-b8ff5bd90c39", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--571a482b-8861-4ff9-8140-6aaa02987d4e", "sighting_of_ref": "indicator--239e9645-bc7b-4ea2-8146-000933cfd50b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c731bcce-133d-4ada-a019-206a84abf4bf", "sighting_of_ref": "indicator--43d28a1f-3dae-4438-a1dd-f5ca805ddef9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8186ffeb-261a-4969-82e3-ac867b002795", "sighting_of_ref": "indicator--9ec860ee-546c-427f-857c-3d370166c561", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--907e21e2-4319-42a2-ab02-64226b2c4819", "sighting_of_ref": "indicator--bf9753f0-6206-42e0-ad15-9930d0840a7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cc3760d-5322-486a-bed7-87f947a1ab1b", "sighting_of_ref": "indicator--c3a944d1-fb37-426b-8408-5de32f1f2780", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e76e3f48-f2ee-485a-9b72-ecaedbace988", "sighting_of_ref": "indicator--2443762f-b4e4-4720-bd5c-a614c637d4c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14793173-684d-45af-808b-05ae3c1244d2", "sighting_of_ref": "indicator--e731dd54-a915-465e-aa12-726c1c5bee91", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fa78de8-c2e9-4d22-9270-86e54c2b497e", "sighting_of_ref": "indicator--f1ac26f5-70d8-4916-8123-7793d8471245", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5d0b53a-5ebe-4201-97fb-3a65a262c4d6", "sighting_of_ref": "indicator--e79b75eb-84df-42d6-8896-38ddd67f003c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b603a224-ac66-468c-b24d-2671a537d0f6", "sighting_of_ref": "indicator--c8554c4a-d2f4-45de-a1bd-eca90d7d8193", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d86aeaa0-52c1-4521-a2c0-7af61e3979a0", "sighting_of_ref": "indicator--3328d2df-bec8-4d0e-b614-d8fbe6142ebb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--824a11f4-c7f8-48cc-8ac8-20f4c4f80810", "sighting_of_ref": "indicator--ec29d8f3-7fb9-4172-bb7c-f041b1e9f55b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a53bd1c-439a-4790-ae91-a5714a637e0e", "sighting_of_ref": "indicator--a5407db4-bc98-4c32-b2ad-84b747ab7549", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa2600bb-e355-43d0-b6cb-02d5c5642e93", "sighting_of_ref": "indicator--8b712bdc-2a05-497f-a309-6f0e3487b16f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f19a06a9-7ca7-40a4-bf8a-2ce51a10f7db", "sighting_of_ref": "indicator--0d18aed4-cf49-40eb-964e-b3d2a4251870", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50f89458-917f-442a-81a9-901170a1a849", "sighting_of_ref": "indicator--17f06132-afbf-4cf9-98fb-724258095704", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c769a4e2-d56f-48de-b667-a08d13aa95c0", "sighting_of_ref": "indicator--7d63ef97-2c2f-4a53-b3de-f8c61f73fd3b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a6969f1-7f4e-45bf-a2b6-e8678a16fe98", "sighting_of_ref": "indicator--a1fbda8e-8eb5-4b5d-b13f-ab553a5a5ced", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90c64b44-9954-406f-93d9-df2e0e5bbd17", "sighting_of_ref": "indicator--313ce7eb-10da-44e9-a545-2ba889da746e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a3c029b-ca34-4c77-b844-99e2cc15b9b1", "sighting_of_ref": "indicator--06a4692a-5857-4e55-8bb3-c06c30e6c567", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02c911d1-8b74-44df-af6c-2d2a9803bbc9", "sighting_of_ref": "indicator--844eab2f-93ed-4544-9391-ac0ca9f1b768", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8ad64b8-e0fc-40c7-a39e-e8c52eccc8a6", "sighting_of_ref": "indicator--f3fe6f66-4a33-4b28-8373-e87360eb1333", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9707b68f-61c4-4cf0-9c21-3391918051e4", "sighting_of_ref": "indicator--d1377c81-4b3a-4f08-a35f-b8a75b2fe68d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f03cdf46-030b-47d3-a0dc-7ae2b4188f1e", "sighting_of_ref": "indicator--3f7c50ba-d2fa-45f5-a37c-19230aeffaab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae23bf34-5031-425f-a7ec-cbd22d23d35c", "sighting_of_ref": "indicator--2e4a28b6-b2a0-4619-b3a9-c0940c9a0fe5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc820a31-a66f-4bc3-a0e8-53102d64afae", "sighting_of_ref": "indicator--ff084655-0a38-4972-83df-f2033be2d102", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d588ddd1-8ee5-4f4d-9a15-447aad258bcb", "sighting_of_ref": "indicator--4e1c2e8b-0c99-4641-9ac1-f3fae4a737e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d1d5ee1-7ec1-4c6a-b4e5-dbfd1afa1af5", "sighting_of_ref": "indicator--8335905a-fa7b-4f2d-8676-822819af29a9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6939513b-5f32-44ad-a29b-a322f1301735", "sighting_of_ref": "indicator--65cc60d3-6ecf-49f5-a203-36e0e1372f7c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--474c4932-c698-4c2a-9240-198f55830c83", "sighting_of_ref": "indicator--bcc9e3f5-d640-48a8-84f9-18ade6737c2b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--146abe80-6404-44ec-adb4-958f65c5078a", "sighting_of_ref": "indicator--3da4ed72-ee0e-43b8-90ab-7be69f21507f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26f958f3-e568-4a40-afad-e495b40a49d0", "sighting_of_ref": "indicator--81ae05c5-aa44-4c55-a7d3-d8bb0808efab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--373a3466-17e1-405e-b869-8f22358b69d8", "sighting_of_ref": "indicator--9907f256-d56e-4742-a3bd-06a2e6bae714", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cf31913-500d-49c7-9978-4d023ac6a7d8", "sighting_of_ref": "indicator--d382585e-2d59-41cc-9c8c-a9ec58030d5b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--693d8fea-9c27-49d0-bbd5-acbd0fdecb39", "sighting_of_ref": "indicator--5d09db3f-3ffc-457c-8acc-977d654850bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acd719b7-1e8d-420e-8c72-21b75b59c35b", "sighting_of_ref": "indicator--057ce287-d6b0-4235-bf95-960348bed54c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7291ad56-5f25-4f3c-a958-d4d0072f4db2", "sighting_of_ref": "indicator--3d7efbcc-ad8f-4fdc-8f42-d4f8f9e2da42", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da7fdd9e-5bce-4328-b962-c729fb52dda4", "sighting_of_ref": "indicator--8c55ae2b-73c2-4a51-b691-74d68690aac8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17626136-a14e-477f-9644-2be9b08dd9bd", "sighting_of_ref": "indicator--29a02692-aaff-45a1-85e1-828aa45a9c91", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a09c19b-fcb5-4e21-98f3-0d6b64cb5caa", "sighting_of_ref": "indicator--ee0777fe-bb6b-48c9-8a79-fc56912de96b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1da6fab4-478a-45b7-b5c1-265fa76ba172", "sighting_of_ref": "indicator--abbf8c4a-764d-4467-a2bd-a00c48a88c90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1d5d347-c8ea-4a7b-91ab-df2f5d8bca25", "sighting_of_ref": "indicator--fa59d795-6360-465a-baca-2de97de7b9d9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cfdc5c9-d0c4-4030-9221-64cfecf22e0d", "sighting_of_ref": "indicator--8911da87-e8ba-4368-a1c6-42ca7d4b6c99", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fe5a74b-1d5e-4d7e-9041-924747276330", "sighting_of_ref": "indicator--01a46169-13f2-4047-a329-fbfec5a075a6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0036ff23-7094-463a-8731-780eaaee622c", "sighting_of_ref": "indicator--dc6f9b74-43e8-4a2e-af6a-5f416fdf416a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3e95f8e-2a33-48f3-97bd-16f2890e7154", "sighting_of_ref": "indicator--fb3896df-0e2e-403f-ba0a-7f72e5a279fe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09fe3194-459f-43bc-89b4-33c6c5f39ee0", "sighting_of_ref": "indicator--1d7a31ba-a3de-4fd7-b0e8-26aea50f1c96", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0af5b16a-1c5a-4e74-9730-2af1f791fbbb", "sighting_of_ref": "indicator--08a6e2e5-ac15-44ce-8c71-dd3a86cf3808", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd7549ab-d076-4394-9c97-477b80766113", "sighting_of_ref": "indicator--0ad61ca6-c1bc-487b-9f30-704d4a5e45f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36844bd7-e85b-46b4-9f1c-52dde7b8713e", "sighting_of_ref": "indicator--5c2807d7-3c13-4e0d-9c4b-8a635e61eef4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e795dff-bd9f-4377-9500-2cad16940e74", "sighting_of_ref": "indicator--ea7815e4-44ba-4dd9-8edd-71badab7273b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19e22782-04f6-4818-a461-e5090d0de5fe", "sighting_of_ref": "indicator--64320a4b-4526-46f7-b89d-b1acc99c6813", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbeba8f2-8257-4fa1-bad7-9ebad6916b42", "sighting_of_ref": "indicator--64320a4b-4526-46f7-b89d-b1acc99c6813", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b198ea6-916b-43d5-89d8-2cf3a874524f", "sighting_of_ref": "indicator--64320a4b-4526-46f7-b89d-b1acc99c6813", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5847c1ee-f9e0-4f8d-9237-259a3645ff0a", "sighting_of_ref": "indicator--65c96377-891b-41be-aeb0-75444f4c5fb3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4c67fdb-4d85-40bf-b89a-b68ae23d2d4d", "sighting_of_ref": "indicator--4da14a09-4e6b-4026-b2d1-2406272b648b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--051a84cc-62da-4315-a64a-e5f6dda3d20a", "sighting_of_ref": "indicator--4da14a09-4e6b-4026-b2d1-2406272b648b", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28cd3bcf-dcc9-409a-97b2-558e136b5203", "sighting_of_ref": "indicator--eeaeedf0-c2e6-48e6-b88d-6c262155a7d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a98c6187-bcad-4586-a22a-d460f6d46c4e", "sighting_of_ref": "indicator--30353017-3bb1-4a3e-a9ab-b59ee5fd9420", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22406a34-3447-47e4-9390-029ca5480cac", "sighting_of_ref": "indicator--30353017-3bb1-4a3e-a9ab-b59ee5fd9420", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42de45e9-923e-4893-9466-9b9711dee32d", "sighting_of_ref": "indicator--0539f11b-e12d-4dc3-8f43-1572e0c7d933", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07118aba-b0a8-4f9c-9151-3849239e7af5", "sighting_of_ref": "indicator--29ce4aab-513d-436d-8dd2-316ef41f54b4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4e84a8-0070-48aa-9d20-1e910cefa6ae", "sighting_of_ref": "indicator--86b0ff95-3099-4077-bdfd-5369737466e3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c2fd08d-abd7-40c9-a042-cf00aa94ef05", "sighting_of_ref": "indicator--8df67fa6-1ad1-421d-a8e4-3da3b9c844ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77eb682f-ad78-414e-b6b1-fad006e78aa6", "sighting_of_ref": "indicator--7fe81b07-2e20-4ab2-abad-6e169c5e87db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--220ee3c0-96f3-4d5e-9107-09249d5cb76b", "sighting_of_ref": "indicator--bd6eeb7b-4621-4459-8e5a-05661589d82f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f6efd77-c17f-4732-9cca-d4eee9b62c1b", "sighting_of_ref": "indicator--bd6eeb7b-4621-4459-8e5a-05661589d82f", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adc0943a-d0ad-461d-be43-e7e275d28433", "sighting_of_ref": "indicator--d9942b1e-63ac-4796-a10a-a7f27f8ad075", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23c06c8c-ce49-4337-9ebe-d88ec87a72b3", "sighting_of_ref": "indicator--7c926194-75fc-49c0-b15b-2e6d550604b1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9702ce17-ea8e-4fac-aa95-f8240ac49889", "sighting_of_ref": "indicator--0ef4cb23-f9c5-4333-b89c-14d89e8430c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6bf48a5-6fd8-4b34-ab62-64e23da0f526", "sighting_of_ref": "indicator--1281849b-e579-4357-ac7f-e9ed3982db29", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13325061-355b-417e-acad-659e9b3c10f4", "sighting_of_ref": "indicator--377f8d1e-5133-4f16-976a-b77b4a674305", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e6d88b7-ab3c-4c86-ba06-ee54d7592c3a", "sighting_of_ref": "indicator--0a6f2150-bb2c-4362-8419-4c08948547de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c95f8905-136c-4375-9a25-7300d801c35c", "sighting_of_ref": "indicator--d909d259-a82f-40ce-9fa0-011b73ec7f84", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da2ede35-df91-4ecc-90e4-a925299d4cf3", "sighting_of_ref": "indicator--7352c769-9901-483e-89aa-a786522cc254", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c63e5ee0-f3a4-402e-8a9d-813df386d763", "sighting_of_ref": "indicator--86715198-6e3a-4194-ba3b-13268ad1e5fb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a6fefb4-17cd-4062-80b2-f3b3274dfe63", "sighting_of_ref": "indicator--e6f68dea-dd08-4ddc-a3ae-cc6bb059a4d5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0043b71d-ada1-4b43-ac83-3d62676f4169", "sighting_of_ref": "indicator--4a51e089-3a2c-4d59-963d-a222a75164f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d290bb6-5e6b-49e5-8bc1-7152761aa34f", "sighting_of_ref": "indicator--4d78cf30-e283-4cc3-b871-61f9290da45b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fef6fe16-95e8-42a7-ab86-98f376cf0d52", "sighting_of_ref": "indicator--f51d7853-c698-46f0-81fd-fa01c80ce1e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17a0adbb-1999-496e-ac37-bcbf25f177d0", "sighting_of_ref": "indicator--e3a98b0b-3954-43d6-ab7b-cbbbbb61d1f7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--672f0cb1-2973-4b90-abe2-13041f5a15f9", "sighting_of_ref": "indicator--c803af39-9a5d-459e-8af8-1acc641b17f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acbc5eae-f03a-4c9d-a4c1-4e4169b24e8c", "sighting_of_ref": "indicator--cd8eeca9-05db-4a39-8058-f619116fa323", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c50a02f8-f333-4092-8383-a043355c1c56", "sighting_of_ref": "indicator--6127e2c2-70e2-4666-ba9f-c30cf1b3e468", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5595b2d0-2e2b-475c-89ab-3eab6ffe4005", "sighting_of_ref": "indicator--12ba9d3a-2a63-41fa-ba3c-d489d2dee0ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73a857e2-802c-479e-a604-531bc6b71cc1", "sighting_of_ref": "indicator--8a38f575-2d33-459a-96e0-700b157e3d37", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe0da1f1-5859-4025-8368-958666cc4b5b", "sighting_of_ref": "indicator--56359b45-2479-45fd-9658-e1d651798095", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cdb351d-d31c-476d-aa43-3263cd0b12ea", "sighting_of_ref": "indicator--bdb5b4aa-45c5-4668-8b43-4f6d03d42937", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e832f2b7-71c8-4db0-be58-06242f4dea39", "sighting_of_ref": "indicator--2e20114f-24e1-41c5-b30d-82a6380f0271", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25baa083-5574-4c52-ad9b-2a3424a99fde", "sighting_of_ref": "indicator--d85332fb-3e3a-464d-88a5-95a1a526c1e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5485593d-65f1-46be-ba6b-8282f6d71a09", "sighting_of_ref": "indicator--03e4b209-3834-46ba-8d35-3f1f8986369a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b0fe4b-0f7d-4672-9f03-97f361d01b47", "sighting_of_ref": "indicator--d9e6da6d-7cd7-4268-b75d-74acd559254b", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0a2e69c-f07f-4492-bf12-f6855b5b1f30", "sighting_of_ref": "indicator--40303641-462a-41f5-9e91-5e273bed167b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cceed0e5-6996-43ef-96e6-02d94a7934fd", "sighting_of_ref": "indicator--45097a6d-673a-4f1e-998f-e9a6fca99be1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--296ed786-45ef-4da4-9705-66613d160476", "sighting_of_ref": "indicator--6b92af4a-0ebc-4f19-91e5-ebee9365337d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a82a9230-5581-48a3-89d2-196e9fe46126", "sighting_of_ref": "indicator--78411a28-3c4c-4434-9434-18cd27aea007", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee483055-170e-408a-ba9c-9c28f3ec2620", "sighting_of_ref": "indicator--a4b0f376-c90f-4ef6-b521-1b0143ec9feb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8afa0123-54cd-48c0-8d3e-eb6f9d2fb9c5", "sighting_of_ref": "indicator--d791f593-1ac2-4378-8796-597f8f1e3b49", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eba95c79-a4e9-49c5-8bba-9bad79ec3246", "sighting_of_ref": "indicator--57029325-8a60-4916-baf2-3f666fc76bd4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dee228b-4777-4372-88c7-ff449f0ac419", "sighting_of_ref": "indicator--6154bd55-f2c0-4b21-b580-a5db049b349d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cd2d2ae-642d-47b0-b990-1869a5ee1063", "sighting_of_ref": "indicator--8b3d6fe3-36e5-42ee-9f40-c652bed167e1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2decad98-fb94-4b4d-872a-8c31647a38f3", "sighting_of_ref": "indicator--c8ab8e2f-1d61-4cd0-8d8c-433b7b828aac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--416618a2-9b1c-4486-9129-7d8939adc225", "sighting_of_ref": "indicator--dd4e5a95-211b-49a7-a7b6-7e7f6af50af4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73de0905-1742-4d8e-8154-42f5a3468830", "sighting_of_ref": "indicator--95282ba4-5cc2-4cb5-94b6-7c913c4a17a3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3df9aedf-2a19-4cca-8b63-35b21870d524", "sighting_of_ref": "indicator--616c93d6-e21a-4ddc-b428-21df5bad5318", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74dd2b05-b39c-4152-9a14-a391a556bafd", "sighting_of_ref": "indicator--cb8a06bd-0600-4cee-9065-ca83ecfd0d8f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4886760e-ef39-4d1a-bf9c-0c869a58ac68", "sighting_of_ref": "indicator--2fd6d128-a282-422d-a9c5-e3d9d5a18d77", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b4f071d-7a56-45f2-8a10-41bc1c35f30a", "sighting_of_ref": "indicator--cc9ee02a-ef8f-4d3d-9982-84d765045e08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e575063-0e42-4668-b83f-8e8e328660b5", "sighting_of_ref": "indicator--109db7c2-65e8-430a-aa9d-65d29f1ac508", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b4f62cb-954e-4239-8f2c-c807649b7872", "sighting_of_ref": "indicator--d434ec1b-e064-4b67-b866-4bf0df3c1ea1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a5a23f1-ae66-44ac-b4bc-3c4ccf3e6ff1", "sighting_of_ref": "indicator--9e66d25e-673f-49d6-842c-9b208290d98e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38e8cbc3-47ad-4247-8b4f-841b5b723b94", "sighting_of_ref": "indicator--3e23abd6-f3fc-4c49-9a8a-510e61babf33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8b0b565-2058-492a-84af-44cbd6ecf42e", "sighting_of_ref": "indicator--0d4aacef-19b3-4bfe-be36-423e7e371545", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b4f0dee-e64d-4392-ba36-a596f50fd673", "sighting_of_ref": "indicator--237463b4-f620-4d05-ba21-014706e4744c", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1f21b25-b17a-47d5-86e8-9f14820373bc", "sighting_of_ref": "indicator--09d386f2-b58f-40d7-a6c8-87c456bcc2a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de235fbc-4ee0-437a-97f2-0d2c7054ab61", "sighting_of_ref": "indicator--c0de540a-f7a4-49c3-b713-e1f86192bf25", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47d5ae1c-f2b8-4307-ba1f-ea42b0c138f4", "sighting_of_ref": "indicator--1f773754-bd6e-4918-820c-412533d77cc0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--417e9477-09a4-4a4e-a6c1-f3fd54aa7e6a", "sighting_of_ref": "indicator--ac0b9a30-c171-4a36-9028-7bd480ab798b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f922d94-0ba2-454e-95ae-c74dc8340038", "sighting_of_ref": "indicator--5423ed47-5d88-4f78-ae2a-1c4dd4d0ba8a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70f3e8e6-a2d6-458a-ad27-9e520871280b", "sighting_of_ref": "indicator--40db1085-22bc-4f86-8ced-aff2a491fcf2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb9d314f-db80-4e15-99bf-029ab793f84f", "sighting_of_ref": "indicator--712f3b48-809b-42be-be15-7f2a513fdc78", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d628c4ac-1dd0-42bd-b005-2d589de0149e", "sighting_of_ref": "indicator--4197dd2b-cce1-48ef-9034-f8a4b4c38874", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cf11f16-292c-4d5b-b343-3deef5d1c81c", "sighting_of_ref": "indicator--4197dd2b-cce1-48ef-9034-f8a4b4c38874", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5958bc31-5ea9-4140-863f-a906c966b11f", "sighting_of_ref": "indicator--207523eb-174d-4b51-992d-cd5b85305b8d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd1344f4-7154-4691-bb9c-e8d503dfbf2b", "sighting_of_ref": "indicator--40d89095-616f-4689-9af7-dfce162b6440", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c196164-ecc5-46bd-8a07-e85ceb563d45", "sighting_of_ref": "indicator--6cf9551b-0864-419e-876b-27888f33b8f9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f72c4832-d34d-4a88-a799-4222eaf69585", "sighting_of_ref": "indicator--04c120aa-15de-43f6-9c1b-91716227c5de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--532f5b54-ff1e-42e6-9b3a-21b751686741", "sighting_of_ref": "indicator--89125dbd-6c0e-45b3-aecc-5d9d173e6552", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84162842-dcfe-4ad5-92d5-a60747295af8", "sighting_of_ref": "indicator--6de79edd-f17e-4cf4-a4a6-ee3f19e96f62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0ba83a2-0ad2-40c6-8872-8a6766f10a0b", "sighting_of_ref": "indicator--3bd7aeee-b9b3-49e1-b11f-16f63d89b3f1", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb677502-2f53-4a77-b790-e373b20ee029", "sighting_of_ref": "indicator--432eca66-303d-43f3-b359-093bbd85c5aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9a14ed5-7da3-415e-a761-fb3c21d8f299", "sighting_of_ref": "indicator--bfaed737-1518-446e-9a7c-124a2be6aebd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d3eb1e0-63bb-4634-807c-b27d867070bf", "sighting_of_ref": "indicator--9a2ea5e0-cc0e-492a-87e5-5abeb44abc0d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff295bdb-b2ce-4737-85bd-3f2a6c21e9c6", "sighting_of_ref": "indicator--f0c0b3b3-0814-4c57-933c-795aa1f6e023", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ad7ed3c-6cc6-425d-8d8b-2344b64338f8", "sighting_of_ref": "indicator--7011ce3e-b527-4609-b923-6604414f3a41", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e8e2bf4-f0ee-4411-968e-2d22e04e0a86", "sighting_of_ref": "indicator--3fdbd434-08db-4397-aa35-d37d27689a15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fe51801-e17f-406b-ad1b-ed523c70227b", "sighting_of_ref": "indicator--618598b3-ba78-4e81-97e5-9dbd7de328b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2acecd8-7397-4845-84b8-94cf1f9391a6", "sighting_of_ref": "indicator--ab49cb06-d07c-45ff-b53c-81eb29da859a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a024cbb9-2299-4520-b78c-b9557a095d54", "sighting_of_ref": "indicator--d9ba3619-65b3-4097-928b-4d54bfc6067f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bb5cde9-6331-456a-8105-139a311c802b", "sighting_of_ref": "indicator--f0eeb224-59d2-45db-81bf-aaae3e10e841", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8930ce95-e9cf-42c5-8c9b-c23d8ea9bb27", "sighting_of_ref": "indicator--a4f36934-b627-4509-b898-dde0d2d9324a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc0e43f-a892-44bb-bc71-edd8dc362389", "sighting_of_ref": "indicator--37e04868-5a12-4e37-83a4-c5191dfe2e2c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4709046d-d03b-4269-a326-637b896fae6c", "sighting_of_ref": "indicator--04bbda60-52a3-4bbc-a32f-41affa830d0b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd3b613d-6179-4344-8d97-2d428879398d", "sighting_of_ref": "indicator--adfb81b8-299c-4bb3-b36f-c68f380d97cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea5c455-3874-41e0-89d0-f7c50c490e98", "sighting_of_ref": "indicator--4c129b76-457e-4530-ae9f-b8dc3eba4594", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20b2be26-48f9-451c-a06c-1b8247820c91", "sighting_of_ref": "indicator--70198af9-f87e-4c0e-93f0-bd570092a430", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bf8cf1e-93d8-4b8a-985c-6229cd3ac278", "sighting_of_ref": "indicator--6a4dfef4-f12b-4393-ad9d-5bad61223943", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab87f197-0ca7-4ac4-81ce-2c885a1b4877", "sighting_of_ref": "indicator--bae7cfee-d7b8-4c84-9273-43ee320636ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--275502f5-6b72-418f-96ca-257012f0e715", "sighting_of_ref": "indicator--23f1a140-5440-477f-95f1-403649dab0e2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c525f09-5025-4c50-9c39-37405e86ab8e", "sighting_of_ref": "indicator--dd4ef77e-2dec-4e4d-a8cf-bd30e34bb0fb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7fa803c-11cd-4595-b4e4-592ae1e6a9a7", "sighting_of_ref": "indicator--b9a0c9e4-9abf-432f-90c1-86e888081ce3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43c20941-bd25-47f6-933a-0e5f731aed38", "sighting_of_ref": "indicator--54c8ea72-4578-4bac-881a-ce80d990a35c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bb987d2-eeb7-4832-9965-a09ea42f4da8", "sighting_of_ref": "indicator--56db51c7-34ac-4ec5-970d-fdbc29533da4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99efaf7c-810b-42cb-88f2-813d8648a363", "sighting_of_ref": "indicator--7279f34f-6da7-4e72-a188-ed7e98d6a2db", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d083d8fe-b468-47e1-953b-d5a6435bf6f4", "sighting_of_ref": "indicator--87281038-c9f7-46ab-a2b8-735a7d0d7d99", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c0f1dff-9903-4ba6-aff0-38e1cf2bb6dc", "sighting_of_ref": "indicator--6d0c3d78-83b0-4aac-9ac3-b13c2dfac3b8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52e19dac-b9b5-468d-9a6e-fb82e03aa4c9", "sighting_of_ref": "indicator--0530da0d-0af5-4fc3-9a23-c538bb9551c8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2914503-f47c-445c-be60-36be39a5858c", "sighting_of_ref": "indicator--d32722d0-e45f-4268-b259-e6527acf40bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf3f2f37-2bd1-4083-9e3c-34fcd5a739f2", "sighting_of_ref": "indicator--929a099f-a9a5-4739-a15d-48f1a0d63330", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a20773b5-a3d4-4740-bd28-b56a8f5d0f32", "sighting_of_ref": "indicator--0a61cdd7-e30b-40c3-8693-6ae7308b8f59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a79b0b-5959-45b2-b9cd-e874a78a0258", "sighting_of_ref": "indicator--97ba0c9f-902e-471b-b21d-87ceb1000765", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96be27fa-541e-4184-84cb-4e015ed08b6b", "sighting_of_ref": "indicator--5a198777-4707-4235-a80b-979a492a6e90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d53fb750-605e-4b12-bd1c-be5378da7216", "sighting_of_ref": "indicator--cebcba01-648f-4e89-a2fd-3e1d741c7c18", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddbb85f1-ddff-4911-bbde-bc90b4601215", "sighting_of_ref": "indicator--0868663b-13c2-4b07-adcd-76280878991e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b26e12e0-101c-4720-aa4a-873a0e40ac8c", "sighting_of_ref": "indicator--1b597f13-4e46-414c-a495-be040f0b3e4b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ffcc279-4dd6-4c66-a717-91a5cdd842b3", "sighting_of_ref": "indicator--bd08c839-03a6-49b9-8c2b-48094ff248e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6093d193-0046-4fd7-bce7-939feae4fe2e", "sighting_of_ref": "indicator--6d2e1eb8-dae7-4695-a1fb-a430044f4978", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77c48335-2f45-4f6f-91fd-1ff36cc9c547", "sighting_of_ref": "indicator--9678a8c3-b8fc-4ea8-a437-9de34af9b1af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ac35bef-e5e6-46f6-b797-f09e144eba72", "sighting_of_ref": "indicator--73f169a8-a384-4b54-8b68-b892564faf7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--407d146e-93d1-470c-a0a7-4d3bef96947c", "sighting_of_ref": "indicator--1ad33e4f-e267-411b-8aab-4556646f2b64", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a0c60ac-181c-488d-a05f-f8a849b5ddf6", "sighting_of_ref": "indicator--8b1d89e6-0e4e-46d5-8041-ed565953e47f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a0094a5-1b22-4da0-86f8-b015515ac31a", "sighting_of_ref": "indicator--c9323400-3a19-4c34-8df4-56d777e90488", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82fb9124-9bf4-4a13-9af2-a5159013314e", "sighting_of_ref": "indicator--07ab099c-308b-4487-8a70-c0978a84d885", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e128dd6-8c02-4430-bb2c-a72371dbd890", "sighting_of_ref": "indicator--629d2d94-f1ad-4058-9d5b-73aca7c8f789", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a4ca808-1900-4f7d-b581-1d4f74f34897", "sighting_of_ref": "indicator--72aa47fb-e541-438f-abe0-2e457534a500", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--762d3db7-4fdf-4e52-98c3-504c07890715", "sighting_of_ref": "indicator--ed3bdbbc-f989-4c46-9b5c-999a1ec7c45f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77f4d317-f3ce-4104-9068-f5b7c8028ae2", "sighting_of_ref": "indicator--8733db05-86e8-4204-a960-b14fa2b8cfc6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--805491b9-bea0-4fa1-b1ef-45c24d8b41f6", "sighting_of_ref": "indicator--b5ecfccc-9c2a-48b0-bcd5-eb501b76958a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--549979d9-e483-4ebf-a4e6-b7357ed8454f", "sighting_of_ref": "indicator--c355df84-c1ed-4053-b2f4-4194d623e6c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c83f5ca9-b235-4455-bc97-34f6c2f54978", "sighting_of_ref": "indicator--7c5aa794-9808-440d-b7d0-39229bcf0b3b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af235027-79a5-491b-9d2f-73a5853426e8", "sighting_of_ref": "indicator--a1c76bcd-74af-4c81-a7b9-107a5025bd20", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb8131bd-2efd-4682-865b-019bde84cfba", "sighting_of_ref": "indicator--3a396963-7b17-406b-b1c3-d218b4b15144", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c72e7fe9-f974-4f4a-ac3a-4a94d03c7767", "sighting_of_ref": "indicator--ec324d17-e00a-4ad0-be89-721aa3be3d86", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c45a5da-3b93-4181-8206-28098e01656a", "sighting_of_ref": "indicator--96290ec3-0286-49a8-b82b-f43ff3b2b278", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb4e9b1b-b44f-4d91-92fd-94fcaf10576e", "sighting_of_ref": "indicator--79335def-42c5-4b25-b0b4-4890eb825419", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9599271c-8f68-481a-9d77-b1508a1cd2de", "sighting_of_ref": "indicator--40d81562-b529-42b2-985d-336baa2ef754", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13b5c3cd-cd63-4a0d-ac89-e3d2bf10b8a9", "sighting_of_ref": "indicator--600559f1-ca47-462b-a1e8-ccde2f2dc921", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--713e9e56-03e8-40ff-abb6-79c124d6917a", "sighting_of_ref": "indicator--f02d1e61-6d50-41a4-bf60-4fd25868efb6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04c58835-ba2e-450d-8102-b3c708cdec98", "sighting_of_ref": "indicator--dd2de106-0b1d-4c0b-9e24-c69ef17e325f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98787c9c-6343-4e8d-aa16-f23d4db8db3d", "sighting_of_ref": "indicator--84c7d7bc-805c-4332-b71c-f1791d6821a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02edc3cb-c8c7-44ad-aee7-94a22662fb2b", "sighting_of_ref": "indicator--862b9d0d-c55e-4597-be7d-a968ac48a71e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba759a8f-bdaf-4e51-b387-106e3e1c0fea", "sighting_of_ref": "indicator--9677b7db-dcb8-496e-b400-12f12655681e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9acbd575-95ab-46d3-9ee8-fc58b7a42101", "sighting_of_ref": "indicator--5d288fe0-7d7a-4752-9e04-c12977e18524", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88f44c20-d038-4457-8ee6-5c1a6a4dfc48", "sighting_of_ref": "indicator--5494013c-f340-435b-b1b0-61ec263597f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bf8298e-a4af-49d4-84bd-238297615635", "sighting_of_ref": "indicator--f39ffaba-13fb-4b3f-b92c-17078cfd8ff1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36034a07-bf79-42ff-ab28-9a5d1169dfa9", "sighting_of_ref": "indicator--302a6068-a809-4111-b623-0a915754274b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7746f568-a914-4aa0-8860-232f88356d3d", "sighting_of_ref": "indicator--9d761588-9bac-4977-9fc5-ed464d22a07e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df9083d5-9355-4249-909a-fe1af0adf5a8", "sighting_of_ref": "indicator--9baeb7dc-df64-4a68-b7c2-63b0665949c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e43e8b2-5fb8-4814-8bc8-100cc429fbb6", "sighting_of_ref": "indicator--b3011441-c104-4e18-923e-2b0627a47838", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eca65995-dd65-456d-832a-2a1f4d8997d3", "sighting_of_ref": "indicator--082d903e-3ca6-4f20-9fce-4d977b8a3d05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8832a244-cb8e-4277-9389-8abf7c7e02b8", "sighting_of_ref": "indicator--1fe3e60d-f798-41ca-b79f-562286290357", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fc0466c-ae1d-4ca3-abbe-0459bf7b520e", "sighting_of_ref": "indicator--938f850e-276f-45ef-8e74-e7ba3fad9f15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3e84ea3-a035-432e-b990-bf2f4eecc8e5", "sighting_of_ref": "indicator--15b4808d-9b64-4b99-9e1c-f3e83d36f5f8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6462f6b7-9b37-41de-bbe4-8c44284e35ec", "sighting_of_ref": "indicator--770a7b08-4481-496c-9e40-ca4b9545f729", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4202fe36-6b89-408f-83d6-812235a7cded", "sighting_of_ref": "indicator--7ff82b4f-6121-471a-903c-692be5fded6e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2033241-7738-4c09-8137-6c5e7e5a811c", "sighting_of_ref": "indicator--b37c85fe-663d-4312-8d9a-1c8447131026", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa62d701-a033-408b-8f61-961c432f8ecc", "sighting_of_ref": "indicator--33e05055-65d3-414b-bb61-ed526ee8bce4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d457396c-3eda-41bc-b6b4-ddcbcb92d09b", "sighting_of_ref": "indicator--7a44d3e7-b6e4-4a9c-b269-676f62853cce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e996612-986f-4939-b7e5-92ec85a59ff7", "sighting_of_ref": "indicator--9a0d9373-9173-4d82-9d4e-35dd212d0a4f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ead90176-a5c9-4deb-80ac-ffdc1b730639", "sighting_of_ref": "indicator--ed56f7a5-e74e-4d3a-b9a1-60b0b35c8b68", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f582c8d0-12ec-48e3-9582-3978bdb05099", "sighting_of_ref": "indicator--d030ad4d-741b-4008-9fd3-9d4b4a8faa5a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b8e168a-2319-483c-8f70-46fb1f1ea8c5", "sighting_of_ref": "indicator--60a282ae-acdc-4ec6-a049-4e23462609a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9db0837-30a8-467f-8bc3-2637eb757b00", "sighting_of_ref": "indicator--a578a828-dbb7-4a9c-9e57-b9203f4ec1c8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d25bf8ab-fde6-4c3f-aef6-e806aabb310c", "sighting_of_ref": "indicator--c7cec032-0d63-4608-a310-1f3f6b0e9832", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4fd73b4-f581-458b-bcec-0dd360b9470e", "sighting_of_ref": "indicator--0fed6088-df83-4426-b11d-457a66aeae29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a8010aa-b60f-4e74-a333-737521b7cd90", "sighting_of_ref": "indicator--bc7efb9a-d39a-473e-b3f2-03159a5d8e77", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22e2de11-c198-47c5-83a8-bd02ae3ce005", "sighting_of_ref": "indicator--11303bb9-e60c-4d30-a28a-d81ab628ff87", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aadc0b1d-c966-4602-9276-db5f22de1790", "sighting_of_ref": "indicator--b97ce76d-7489-44a6-9879-4a1881c4edcc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e0cc96a-b967-4a32-ae5b-5f00d54bc85a", "sighting_of_ref": "indicator--4e6dbae6-6107-4f77-a071-871cd72be908", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b7dba31-b3f0-408d-b740-34007868003e", "sighting_of_ref": "indicator--27854030-5c85-41de-a710-fbeffd582c69", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b78c45a6-8876-4e3e-b93a-19cbab268a08", "sighting_of_ref": "indicator--06f56f46-5d27-4c4a-bbb0-a54154bcb123", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39148e2c-51b1-4ded-b5e1-f559e28922c3", "sighting_of_ref": "indicator--63c18c8b-7939-41ae-9a24-25c7bdfa1a0d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--492a766d-1cfc-4aff-9e94-bdd6c08e0d77", "sighting_of_ref": "indicator--d077a8b3-52a7-48df-9e8a-88143d49d1c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5cd56d6-001f-4a67-83b6-35a9f49064ed", "sighting_of_ref": "indicator--0f1ce034-c2d2-4740-887a-38def563e047", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26d50110-a889-4285-95f8-24c243ece2ee", "sighting_of_ref": "indicator--8209674f-5768-485e-bcb6-14fbdcd2a2df", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0995a451-aca9-4b65-8bc5-43286e95c26d", "sighting_of_ref": "indicator--d9f642b4-c278-4505-9267-1bcd2360b85d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27d019eb-52ad-41b6-ab04-58a0350e9dcc", "sighting_of_ref": "indicator--e6d788b5-f0f0-4a65-8432-3b550e8ef231", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a4fd4c4-7b2c-4ffa-97b3-1906b418f393", "sighting_of_ref": "indicator--8e374a3a-243c-49a1-abfe-4c3b0c4fdd8a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b6ca106-c96c-4e7a-afa7-82543d992bbb", "sighting_of_ref": "indicator--c6ef85c6-50d9-4f8c-9fcd-45d2e0d54515", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b8b135d-d858-42c6-bb77-0d6613bac55c", "sighting_of_ref": "indicator--cf731525-2df8-433d-95d9-5b1c86760dd3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38597070-54b7-4ed4-9813-f7b53bcb0dac", "sighting_of_ref": "indicator--2f2e084d-bb33-4ba7-989a-76772d5a2099", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--745ed1a6-64fe-4557-b863-393aab0cc324", "sighting_of_ref": "indicator--61e4b4af-025d-4671-8d73-410fef9cc686", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ee88433-ca2f-4599-ac64-b83c384572ba", "sighting_of_ref": "indicator--4ad05bc2-ea85-4e4f-af3f-0d96ee03ae39", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b99150c5-cb18-4434-bc5b-9abd53de4272", "sighting_of_ref": "indicator--eac6ed03-060f-4388-bd5c-9980d7c7ec65", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e46e7b7e-bfae-405d-8e3f-15c0ea8b1cc7", "sighting_of_ref": "indicator--b29b888c-8d8e-4aff-a335-640f52237661", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38e87f3c-f603-480f-bc09-ef9278a26d33", "sighting_of_ref": "indicator--57f299c8-fb75-4edb-8a33-1e72f93741bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae3c7f21-0e8c-42f4-ba93-5406c266eb2d", "sighting_of_ref": "indicator--a7ec3de5-bd29-486c-aea9-15fbbf9fba5a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc12d00-ab4c-435b-af72-5d37a14d3bad", "sighting_of_ref": "indicator--a788ad27-a47e-4f00-8eac-98b98d9d7233", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a145644b-85c8-4cd4-bd10-1acf4b495ff2", "sighting_of_ref": "indicator--364a0984-904a-498c-a6ba-bf6165c36742", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c79ad274-6a6f-4ede-81f4-7371f44e07ae", "sighting_of_ref": "indicator--d245effd-30eb-48ce-9731-af8fdfd7d480", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd87915f-a9d9-4e15-91ac-0e4e315c6969", "sighting_of_ref": "indicator--12a10f8a-a30c-4e6f-8c9a-ffb9e3eec849", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c87648e3-d695-436b-a3ee-958e562a9c68", "sighting_of_ref": "indicator--50a5a07f-292d-47e7-bce6-04d35063eb88", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aad67b60-4082-455f-a06e-7ec41727d4c2", "sighting_of_ref": "indicator--75e6ff30-94f7-42db-a740-b5780fe7024d", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8e99678-2d02-4978-89b3-a3b29fe45aab", "sighting_of_ref": "indicator--4e90593e-3b62-470b-ba36-ebdc320f82cb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47029623-cf5e-40ee-a961-cb02ac2f10cc", "sighting_of_ref": "indicator--ec4ac249-c253-4bcf-930c-5443eb4507a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a9eedae-c63d-438d-bd2d-0df8bb260d49", "sighting_of_ref": "indicator--9b0bf751-b350-4913-949e-9eca1cf332a6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0859236a-3c2c-4e11-99ad-5eca10e12e34", "sighting_of_ref": "indicator--04554756-8478-419a-b327-a5ff6e70b949", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c78ad937-e427-4eb8-a37c-29abafd5986d", "sighting_of_ref": "indicator--0c0c6be8-7b72-49b1-815d-65f0b4b99a28", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dee99a29-f5bb-4a94-a41f-7e41ead17eb9", "sighting_of_ref": "indicator--b44312a4-a257-4a9b-be66-cd0fdcd24e88", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89509613-16c1-4636-a04d-348615cac970", "sighting_of_ref": "indicator--ec89fae1-488a-40e9-94be-4b8dce763064", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4da222c4-642f-4545-9c28-ed686de10b30", "sighting_of_ref": "indicator--03ea455e-5512-44e8-b56a-d0a02b1dd08f", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2864844-c889-42c0-9687-c1c9679b24d1", "sighting_of_ref": "indicator--679d695f-6d69-42fc-87f3-22cbd8ca7a8f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ecb3102-2821-4e12-9524-37e7b9aaee99", "sighting_of_ref": "indicator--403be310-214e-4004-b19c-7756e07a5e2e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da3719d4-1f00-4d3f-82b2-dc71831c74e6", "sighting_of_ref": "indicator--2279a348-6b47-4336-85fb-c68716daa348", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c6f83ce-2986-465e-b143-7eb2d7e96900", "sighting_of_ref": "indicator--fbed34e2-5d07-4702-a964-ecc031e5a95f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea701de1-de8a-4f9f-92bb-c65a7187b897", "sighting_of_ref": "indicator--210adc39-c44b-4296-bcac-ac4845fd6e15", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--911e06a7-8c20-47fc-8032-a2799c0a7fe7", "sighting_of_ref": "indicator--eba51841-a48c-4baa-9771-380e68742b99", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c713a4a-2f9d-49a4-8b7f-9c996e3130e5", "sighting_of_ref": "indicator--35f6bdc3-aba5-45c8-898f-619779243167", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31e0c86b-ee74-46ec-888b-378422f2db9d", "sighting_of_ref": "indicator--482a3f71-bd52-4400-bbab-39049ecf7aa9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2cea239-ab6a-4f57-986d-3f1c5961035c", "sighting_of_ref": "indicator--c87c4e3a-bbe7-42a6-993f-c38d503e0495", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83fcb783-d758-49cb-a26d-ed7283b6392c", "sighting_of_ref": "indicator--271e911d-653e-4205-b960-56062ae96685", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80a1caa2-f578-450f-ac56-fb9e98425887", "sighting_of_ref": "indicator--84839620-124b-4c6c-8fd3-90469663f659", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82f1120e-a5f1-481c-bba5-8b17c025532e", "sighting_of_ref": "indicator--ab05f159-6291-48ca-89f9-38698b714157", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07b46e21-b3a0-428b-85fe-5fc3dfc95306", "sighting_of_ref": "indicator--92ee5821-d0b3-45bf-812b-bac507be771d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--352e4255-a20a-42df-b5a6-0eaf623323b6", "sighting_of_ref": "indicator--3bcff94e-7b37-4e10-a1bd-de2e4eb84068", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbc29621-f674-499d-9d61-20a0f1a6abf3", "sighting_of_ref": "indicator--84eab66e-2197-4170-a8cb-45e761d68d2d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3371d682-9d63-434f-b87a-c2fc99ddc378", "sighting_of_ref": "indicator--319a5214-3bdd-425e-b480-8d39524751cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4af5626d-8ca0-44da-95ed-487c9f582db5", "sighting_of_ref": "indicator--7e9bec6b-92d8-4f29-874f-e23d09c4d3de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9093377a-9552-4ae1-826d-a8a45fdc3701", "sighting_of_ref": "indicator--113787f4-f86a-491c-843f-64db46e40f8b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11085a6e-c9fc-49ff-9a4f-f2d522885511", "sighting_of_ref": "indicator--9289fd0d-4751-4444-a0ec-fb00ca57a0cb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a46b2224-866c-4233-8c39-dbc294f85b4a", "sighting_of_ref": "indicator--d8c19c78-2b52-4470-bd9d-04d135a773d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d131b6aa-856b-4d78-82d1-96bf92e6da33", "sighting_of_ref": "indicator--c61e702c-88d9-44ae-aed0-f3eb3ddbdb30", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0cc8c85-cd4f-474a-849e-119ffbdb0de7", "sighting_of_ref": "indicator--ba8ea614-4e26-45cf-97be-7cb0c972aa4a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0502a612-c24b-441d-9de0-0a62fa394c19", "sighting_of_ref": "indicator--5f37d99f-a14e-4602-b2d0-3338bf6e0a5c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48039a3-6539-4009-bf70-9c2987e594f7", "sighting_of_ref": "indicator--c0620b7d-80bd-4b13-bd0f-7cb74d7b45aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cf67742-074b-48b7-952d-8cf5fafbb17d", "sighting_of_ref": "indicator--c46ade62-6dee-48d1-9746-e7e1038177c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13d38462-eed3-4f09-a800-8a876ae93b35", "sighting_of_ref": "indicator--4c0d6883-74ae-4c6c-912c-dac00e9b2bb1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bfb14fa-200b-48dc-8d6b-ed37d5855805", "sighting_of_ref": "indicator--5b5df6ae-be1b-415e-aebe-1e94cd030e84", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f73d0a40-7cd4-4678-b0a5-0949889bbba6", "sighting_of_ref": "indicator--4bd806ec-e23f-4270-8cc7-7aa6235af23c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a81acb27-e18f-496b-8a4a-76b65d452220", "sighting_of_ref": "indicator--0e1dcc09-8618-430d-a12d-59e1810f1526", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf40777f-d7b7-44b0-ba3a-32b7d5119d22", "sighting_of_ref": "indicator--92f9735b-d765-4578-9583-b163b7559225", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4ee04bd-4b92-44d6-8929-8619791f6c95", "sighting_of_ref": "indicator--e72cca97-837b-4fe2-afd1-2ff3434a781b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ccd48e4-4701-4f73-b81b-9f15ec9d818b", "sighting_of_ref": "indicator--751aa984-3e4d-48f3-94d1-15cc44310085", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab3b4c2f-aa24-470c-8e51-bde63230867d", "sighting_of_ref": "indicator--1aa3202b-fbaf-4d88-aedc-5288e2ab993d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bbf5d1f-ba5a-4c69-ba01-08b62e39565b", "sighting_of_ref": "indicator--a3ced762-3c14-44eb-8994-98af9c229b40", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7766ddac-c965-4974-abe4-55085f774412", "sighting_of_ref": "indicator--a1e49654-7a8d-4433-bafc-ed8d35a7af23", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fed0900-ff98-4d02-9b37-5ac8cffca5c3", "sighting_of_ref": "indicator--51bac319-b443-489c-b6c3-2bc4298a85b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e5e5dda-6e1d-4d39-8d66-26fe59e88f31", "sighting_of_ref": "indicator--e916d454-0cd3-4b84-9264-43cd945e604f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afc63f88-b00c-4476-a8da-a956cc3a90a2", "sighting_of_ref": "indicator--99ee6d3d-72f1-4d72-9c98-7ec6ec441cd2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c53a98ee-3ebe-449d-948a-0b9e7b0e1da8", "sighting_of_ref": "indicator--09f39647-a377-48aa-9110-43210aad0b32", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--784d0d82-8ff6-4e02-9c3f-4300f90578f8", "sighting_of_ref": "indicator--2e27025a-39c9-43d1-81d3-38524b6d3c3d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7513f132-5eb7-4182-bd80-99e9c26d6c46", "sighting_of_ref": "indicator--8458ddac-c071-4e2c-89e1-c4681c9107af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1667fad-15a0-4fce-874d-c1754c94791c", "sighting_of_ref": "indicator--5e70529e-ce8b-48a3-98b5-f4d4a0d5f74c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4045946-4470-4589-b234-defcc757498d", "sighting_of_ref": "indicator--975f8008-f487-4bf3-8db0-b0d8b629be9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9236ea8c-1dc0-427a-a5da-d8b3b0950fae", "sighting_of_ref": "indicator--8a9e1342-6c99-43e7-9a71-7257f66059d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8e3fb9f-0755-4357-bbad-41c4757dcfe1", "sighting_of_ref": "indicator--b0b0b7d4-8b90-4407-806d-08542999637b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0064bba9-686d-4d24-ae75-c424626aeda0", "sighting_of_ref": "indicator--f117c325-275f-41f3-add3-e174580117b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68478ac5-1749-4f21-b2a8-f232d5349b10", "sighting_of_ref": "indicator--3af74087-03da-4998-baaf-d52731ed6cf2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--173ec97e-d636-4f69-9960-5aec187754e5", "sighting_of_ref": "indicator--cfce7bb7-8bfc-4cb5-84d6-83075332f95c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e8701d4-004c-409b-913c-e8009cfcc9bb", "sighting_of_ref": "indicator--e679d104-d720-4cea-88e3-541fc272b569", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--640c8d3b-a453-480d-985b-9485c8c7709e", "sighting_of_ref": "indicator--7527371d-83be-4521-9c84-043550b81dad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1308c529-6af4-43bc-977c-47a21b9cffa0", "sighting_of_ref": "indicator--34324676-596c-4f09-b31c-09d2a83e5112", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16bc2150-9481-4886-89a6-1dddf21609e1", "sighting_of_ref": "indicator--9437c3c5-7c93-4f58-b960-e8f00c2a37d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0a4b1dc-c404-4a4c-b652-fefb593ff22d", "sighting_of_ref": "indicator--abcb7447-9374-4352-bff6-0709624cf069", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--809ecc22-f258-432a-ad9a-615245433dc8", "sighting_of_ref": "indicator--d0367e1d-038f-4e7c-b9e1-7194c86821fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ecb5955-f399-4c51-8884-73fa709ac6de", "sighting_of_ref": "indicator--baab8cb4-cf09-4427-847f-18b6c3115c7a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73530cd1-b40f-4323-adc6-b69cb118a12d", "sighting_of_ref": "indicator--a25869df-0bf9-49d8-af0e-026500a857c2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff8c6f9f-6fa0-4bdf-b3db-38c0fe8e79ec", "sighting_of_ref": "indicator--a587da14-71e9-4845-a719-d171e8449d1f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a6a63d5-4fe6-470f-8e8b-53b8325fa14c", "sighting_of_ref": "indicator--00fd6de0-7584-4205-abf9-4d8f636a1a81", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bad0896-52fd-40da-a6f0-c3854ca78847", "sighting_of_ref": "indicator--39ecb842-0fa2-46f8-9d9a-dadf5976bd05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72567d12-7ced-4418-bb29-a4327e4da682", "sighting_of_ref": "indicator--fa1b7163-399b-4fe0-9b67-93476333badd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4853a003-fdb5-4637-ae2d-61d26f4517bc", "sighting_of_ref": "indicator--ef3bda02-0e4b-4e7c-be0a-8c172752d124", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d79d3d31-8f90-47df-b4e5-06e676476149", "sighting_of_ref": "indicator--41fc7a0d-0ec8-4494-887c-385e4e2c0d0e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5390c771-b89d-4772-bb75-22b82b491f33", "sighting_of_ref": "indicator--8580120a-4195-4ff3-a6a4-698b28dbb35a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdde3052-6002-4590-a354-36e3f2571637", "sighting_of_ref": "indicator--bdbeb9a1-6426-468b-b00e-9c8e5a975aad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbc89915-edcf-4594-988f-e1453b4a364b", "sighting_of_ref": "indicator--8f5eadad-2022-410d-b5dd-957439fac01d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ab5e78c-e753-4ade-82bd-3d4fbac1d90f", "sighting_of_ref": "indicator--92b00ff5-4b72-4ae7-9c04-03ca1d6dff30", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8328939b-f85f-4efc-aac2-cf20a0a5423c", "sighting_of_ref": "indicator--1cfa4b03-7d03-4e2e-ad6c-f6f681136275", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e82b34e5-d998-48ff-b4b7-ff36f42e228a", "sighting_of_ref": "indicator--a7b6301e-a38c-4b74-bc57-115bba7a6d7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e008dd2c-e85e-4a9c-b85f-f64d10062111", "sighting_of_ref": "indicator--be700a1a-ffba-40e1-90ae-50fb3a33a775", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce02985d-272d-450f-bbf1-67516953e3a0", "sighting_of_ref": "indicator--5f70b4fd-9650-405f-9979-0db229f33232", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f4d9600-1471-4236-afd6-5450946a2924", "sighting_of_ref": "indicator--e04e6986-96c0-4ba6-abb6-98545e17743c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6448a1e2-5dc1-4e30-8470-e81ae5248ec7", "sighting_of_ref": "indicator--0e843c4f-5329-4ab6-b9e7-b72f62155cc2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7b48954-e043-4bee-8dc3-0195b7dff819", "sighting_of_ref": "indicator--108e0cc9-d88e-47db-ae07-e758c4dd20cf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29c3363c-c32a-446e-bc96-a15aa83829b7", "sighting_of_ref": "indicator--cf3dfb1f-0475-4714-9190-70f00f0d1a46", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d16026b-a46d-4b09-807e-5631baeb3596", "sighting_of_ref": "indicator--5a065fe2-83f1-4a1b-93a1-895ceff252a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--365d1583-0463-4ad2-aad8-15d62482d04f", "sighting_of_ref": "indicator--0a28f7f7-8837-4e7e-9423-272f38ae0adf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c5c926f-7b99-43a0-82b2-be8f971f90f5", "sighting_of_ref": "indicator--5771f642-157b-457e-b3ee-587fb9153a85", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d7934f5-3d00-4b7f-af18-aff4f405a4b9", "sighting_of_ref": "indicator--b153ae21-9d82-4d4d-bdf1-500d24958db2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a14ef669-6f45-4414-a0ae-c481a4e903ed", "sighting_of_ref": "indicator--1d8d2de4-6a6c-49fc-9da2-eacdae489652", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee84d110-c657-4792-9254-47fafab50ebc", "sighting_of_ref": "indicator--4133b140-8958-4e56-8fb7-8c59f8706e30", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62fd29d6-78a0-4d28-ac2f-57a46402441a", "sighting_of_ref": "indicator--f76f1660-29e9-47d8-bdc3-e01787b05c47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84d9aa7c-666f-49ed-8e9d-ae0abce904dd", "sighting_of_ref": "indicator--c6629f8b-ba13-4c7e-aab0-2a84d1d0e420", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80754711-c4c7-45af-b4aa-a0164b2996d2", "sighting_of_ref": "indicator--85eee3f3-d4f2-4944-b777-6298246f8273", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3289d9f8-3c22-43df-9959-1600f80f3221", "sighting_of_ref": "indicator--79dfa506-806e-45e1-9b85-bee61622b345", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--416de464-3dfe-4d82-a728-9eaec3ac435e", "sighting_of_ref": "indicator--c4a16823-0a38-47aa-8c11-e72b55f7e790", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04a60f61-e102-4f31-a15f-7bc67043e52a", "sighting_of_ref": "indicator--126a3afd-ba47-4737-9876-5cc103115f82", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e77f8491-bfa1-41f1-a883-8750df0692dd", "sighting_of_ref": "indicator--b394dc04-65a3-4cd7-aab9-9c625de91147", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8076c4d8-214a-441b-96f8-3ffd41a59e94", "sighting_of_ref": "indicator--0bafc46f-81f8-4d77-9b09-2f9c7f80cb8b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a5f7ebe-1472-4df3-87d0-1ccbdfe5d958", "sighting_of_ref": "indicator--3cd0ed03-1dd3-4f40-82b5-740b66479ff5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa1d9149-b431-42ea-8b17-58aa6b599854", "sighting_of_ref": "indicator--49a0ffb9-5d28-4083-a6d7-34075fd6f1dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46e8617c-0dd7-44d3-855c-3667212e9025", "sighting_of_ref": "indicator--da21d6b6-adba-4c3d-83c6-ea3a6e9829bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99c7751e-bd95-4175-a7e9-37afd7e6fe7f", "sighting_of_ref": "indicator--473c916b-4aa7-4789-9bc2-547388b3b9b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11d94b02-3467-4d3d-bc65-e908a0cbf246", "sighting_of_ref": "indicator--428eed41-26bf-4c98-8e31-0f7f27d977b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--355c9fff-bcd5-414f-87a2-fd40429a8b26", "sighting_of_ref": "indicator--65cb5447-8594-43ce-9c8b-d68ea293f924", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5f17961-d9e2-4a32-bb22-fa85d04b8974", "sighting_of_ref": "indicator--f272e78f-4ed5-4131-b906-2de2ca192ef2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbf82275-142b-4167-b0a0-4360046d5f8e", "sighting_of_ref": "indicator--66d0d25c-71d3-4547-803e-c9e2126cc4ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdadd1eb-22fc-407f-80f1-ed1d4585f206", "sighting_of_ref": "indicator--e8f8f2fe-0c36-443a-8ab5-1ef4a72e8a61", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8a59ddd-200f-4bd1-a490-dd0c72318f1c", "sighting_of_ref": "indicator--210a5885-06e6-4aaa-b8ce-3991102a2d71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2600ace-2923-42b2-898d-aefbfb8e12f1", "sighting_of_ref": "indicator--aae503fa-d0c4-4648-ab68-5f5472143704", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98b4aed6-b9e6-4144-b5c2-1236958455e4", "sighting_of_ref": "indicator--199bfcc7-1688-4de3-b0d4-86d4823fa94a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25ea2e18-267f-4024-9d38-c961d8b5821c", "sighting_of_ref": "indicator--c7d4e0c4-8656-4c2e-a2e2-e060b8da6e16", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f2734d-7bf6-4595-96c3-0a0098481d2d", "sighting_of_ref": "indicator--5a05156e-1f6b-41c1-b7b7-9b7c2f711b74", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37d4c7a3-5b85-422e-92d0-a256a3e9d97f", "sighting_of_ref": "indicator--5602b73f-237e-4ea5-a5de-84de9cb8c9bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0e2e2b3-8a44-4cb3-a776-e608ba21da96", "sighting_of_ref": "indicator--e84aa6d2-65e8-41a4-8212-f2de5ea0cf8d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74e32c2c-1840-494d-aa9c-89efcc5d97b6", "sighting_of_ref": "indicator--343d2757-9506-4bbd-be1f-bc4cdc6863fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f940d85e-9cfb-4281-84a8-a9c6b490da01", "sighting_of_ref": "indicator--091310a1-65e0-4780-bcc9-5d1d39e26f61", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40c69a83-4a0e-439c-8759-6953a758f731", "sighting_of_ref": "indicator--272bfeae-cdeb-4058-89eb-c9770c1a493d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e12cc44e-1fdb-487a-a7c6-1ad0126584dc", "sighting_of_ref": "indicator--dde236ce-694d-4a38-83ec-832ad9a07aa8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dab3137-5dab-48e5-88e3-049e958f6433", "sighting_of_ref": "indicator--61e8760e-3b8a-4b62-8bdb-d8b43c5806b3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04badd39-8e7c-4436-8035-02a41384ad5d", "sighting_of_ref": "indicator--f4ee9d39-4823-47b2-8757-cb40e21f2f1c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56445522-791f-49ef-8ea6-a33566d05a7a", "sighting_of_ref": "indicator--58631ba0-5d45-4bd9-b3fa-b89b53dce6cf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdf7a836-e342-49fc-b0c9-4b35f8d47cb2", "sighting_of_ref": "indicator--63205bdd-d2b1-4a66-8965-4a3b5bcb8079", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--352dd6ac-075f-423f-acbc-276dd9e02468", "sighting_of_ref": "indicator--beaf5391-a95f-46cf-b305-4993c1a255a7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f573caf7-e08b-42db-bec3-cfa163ed0308", "sighting_of_ref": "indicator--f39b9b8e-9a9b-4195-8b35-26d0564704eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29c1a832-000d-49e4-8fb2-c3e472820fd9", "sighting_of_ref": "indicator--13123455-72e6-40d3-a040-7ed3e400b53f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d22926b-1beb-4ce0-863a-3f3e22dfb24d", "sighting_of_ref": "indicator--198e98d2-c3ca-4364-8d9a-19376522dba4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--037450de-cdea-4b7f-9010-fa400e53a923", "sighting_of_ref": "indicator--68002c52-9125-41b4-b671-42497f31bf57", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cede034b-3fd5-4eb0-82c1-d17fb3b3d5e6", "sighting_of_ref": "indicator--69ff543c-95cf-49a4-a451-90436bc83b35", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a960957e-7fad-493f-b38f-acd728ad4882", "sighting_of_ref": "indicator--f614eeaf-8fe5-4cd7-b58c-2920a9d99b4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe6b46c8-4b15-4341-844e-af36db4ea0ec", "sighting_of_ref": "indicator--a7f680c7-471d-4846-b56d-f45d3b40718a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3064001b-f5a3-4705-86d6-c8902f981055", "sighting_of_ref": "indicator--aa113a42-3e59-4b71-afe5-6735daf201e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--add5c91f-7ca6-41ee-a642-9a4e743cfb68", "sighting_of_ref": "indicator--d5e0c5cb-11ec-414b-831d-f3b924ae494c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57b57bf6-2ce7-400d-8594-0b1abb756720", "sighting_of_ref": "indicator--7d3d3c7d-2193-49d6-af9b-763f71daba6f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e28d033f-a87a-4b77-bf4f-fd1749d80986", "sighting_of_ref": "indicator--34cd49de-245e-4537-9551-04845468f177", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--861f3d16-9072-4330-ae51-18da2c0a0869", "sighting_of_ref": "indicator--29c6f9b5-0360-4767-b629-a22bf1a3ded1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04d1ae86-1956-4098-9e49-bd77282d7cd8", "sighting_of_ref": "indicator--65f0d1b2-5c7a-4443-b63c-9c0f05b4a49a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dd1bc5b-6448-42ae-800a-c58f8edee20f", "sighting_of_ref": "indicator--6f84bebf-a806-40d7-8349-bc5b3ae574f2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d3430f-b508-4504-9bd8-ffc88bb46c83", "sighting_of_ref": "indicator--fe650ff4-f7a6-4ebc-81ad-890eb5aa12e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18afae9e-aa47-42aa-a700-056cabb07aa1", "sighting_of_ref": "indicator--e04427ef-01ac-4959-9d96-d72d8eb757fd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6043ebf-2d9a-442a-81c3-04ecb189a97d", "sighting_of_ref": "indicator--0925e459-9655-45c8-bcea-9d9e244796fc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7d64d25-2c4b-4bc7-b947-38ecdaa74393", "sighting_of_ref": "indicator--ca39ef50-5d2e-4457-afea-b30b2de1eed1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d3e3b49-cadb-4162-b4df-3c53fa0de9d9", "sighting_of_ref": "indicator--0ae6f2ca-d219-4da0-aaf1-2ce770a506dd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a11c405-f9ce-42e5-b028-8437e844cf81", "sighting_of_ref": "indicator--bdee2e53-04f6-45f5-808e-ec1992054fa8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea12a47d-e517-4fae-a60d-545e5157f995", "sighting_of_ref": "indicator--d77593f9-1728-4129-9255-70ae6194486b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16bfaf0e-9823-4f57-b25b-9ffeccb4031e", "sighting_of_ref": "indicator--7e9b322c-502b-44bc-a35f-16515ccc185b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--538f1909-bf46-4bad-95fc-192f56267412", "sighting_of_ref": "indicator--d1ef0c80-5033-4e49-b3cc-57d8c5c7abb7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e58fceb-48ac-45ee-9377-d668730b66a5", "sighting_of_ref": "indicator--c5d11a41-d525-40a9-80b0-6452242e9561", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--992d36f8-65fd-4da9-b011-cacedc9ec620", "sighting_of_ref": "indicator--b88eefcc-0b6f-46bf-8011-b3cbbd443edd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef2f5bce-05f5-4bb8-9ed8-d8e3ad29ddd0", "sighting_of_ref": "indicator--a7ab427f-34c7-4a26-9107-0dbd64070c62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d29690fe-9b16-4ac1-b8e6-a7b21d04f70a", "sighting_of_ref": "indicator--a4b2efd5-5e74-4292-8244-ce087ba11db8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7464463f-f0e2-4b55-9a37-a4516ad030f9", "sighting_of_ref": "indicator--4b4bd5b5-e5e3-4418-9fba-c99abc7068ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc756a9e-c9e3-4420-ad37-3bf907758ad9", "sighting_of_ref": "indicator--bab78e5f-b39b-4999-a298-72037c5a13c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d46996d6-663b-42a1-a51e-2caeacdbe401", "sighting_of_ref": "indicator--e8ea99a9-50fa-4fac-af1d-fb0110c51169", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ad7dae6-259b-415c-8a99-2ee9c0817b4d", "sighting_of_ref": "indicator--9aeb34d8-2008-49f6-bef1-ae17fa308b2f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--395c187a-0309-4547-b89b-a715f4aebb5e", "sighting_of_ref": "indicator--3954beee-3851-45f5-9d89-77d5397c94cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b783d8f-3728-443c-a553-440e37e692b6", "sighting_of_ref": "indicator--e9082a38-3430-460c-86c8-66774b5f1448", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--021f1d4e-eec2-4734-a775-5110eb12a834", "sighting_of_ref": "indicator--a362f2f7-d9e9-4119-93c4-ca51bc275fa4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5a347bc-15e1-4f65-87bb-0f2e37853e8b", "sighting_of_ref": "indicator--9175c65e-cfbe-47f4-a798-3393d8df1ac5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c452d6-0fe2-40c4-8460-013f5e2f5e15", "sighting_of_ref": "indicator--3ba05bc4-68d4-468c-a76b-1d8d99a0305a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02708aa6-8a46-4e4b-8e28-711436a14471", "sighting_of_ref": "indicator--1924ace4-8604-4230-87c2-959282a8130a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86072fc7-a69b-4c85-a725-759e0487ab89", "sighting_of_ref": "indicator--02d6088a-7fad-4e09-96eb-a1515e3f4be9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26cc943c-b4f9-4217-b5f9-9db5bd3ecac3", "sighting_of_ref": "indicator--dd09fae1-244c-452b-8e39-16d37d8e70d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73df0820-92ff-47fe-95f8-57937538b9de", "sighting_of_ref": "indicator--b66f9c6e-ecf2-45d2-baac-23cafaa8a3bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6ef9837-5b8a-492b-b302-350a9494b642", "sighting_of_ref": "indicator--1f5849a1-9ab4-4106-bf4e-c6598f6f8702", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92570422-ad06-4ff8-a78b-6b50d54ea401", "sighting_of_ref": "indicator--3eaea36b-6e77-4f6b-b881-318b4e101e1e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c61b4a5e-5401-4576-9418-aae029b146e2", "sighting_of_ref": "indicator--bacef48d-7dee-45db-9689-f5de481261bc", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3677613-e69c-42eb-a23f-410f221aed57", "sighting_of_ref": "indicator--5b7f9a0f-ab3d-45e1-b6cb-b579cefa2bdb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e9d7366-4635-4588-83e7-c4f361ee6fdf", "sighting_of_ref": "indicator--cc0613bb-e172-48e0-af39-bec0e3fe4768", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c252a46b-7d31-4481-b800-c6d8bd61660f", "sighting_of_ref": "indicator--75dbbfab-c230-4e61-baa1-c84b87b9bde9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--900fcefe-dd43-4c1c-a227-4b3a0a849f3a", "sighting_of_ref": "indicator--3be9fa86-5137-46f9-8730-6db595ba5259", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed2fd0eb-ddb9-459d-ad6f-7b836b537207", "sighting_of_ref": "indicator--316a05ac-44b9-4d0d-9afc-3459d173ba97", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48907628-121b-43ed-a17f-c5ceba9bf14f", "sighting_of_ref": "indicator--7cab72ae-5bd6-41c3-92fc-00b745dcced2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57e6606d-4e53-41d8-9bd7-c4850476366a", "sighting_of_ref": "indicator--bebe4d3f-8de3-4ad8-9f94-914d20b23971", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3309fe17-e439-4e8a-ba25-0b5281ab70a2", "sighting_of_ref": "indicator--672182ba-0def-4fcb-beda-0b185456b5d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae17c03d-71b2-4c61-afa5-80a89cb3d1b8", "sighting_of_ref": "indicator--1bafa276-58b5-41ba-ac3c-3a74764036c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bff2b283-acfe-4776-a071-72c9720f2a9f", "sighting_of_ref": "indicator--bb4e6d97-0ffc-40bc-a969-206cb877c179", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d7c22cf-cf4f-469e-97d4-5ef5f0ebfb5b", "sighting_of_ref": "indicator--8c1a7067-3319-4354-8a90-b2b4baab97a5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63fe37a9-659d-4b14-ae0e-46de0266add8", "sighting_of_ref": "indicator--c5b4edac-2548-4484-aad5-7f48f4167ed3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99d10329-e27a-4737-8391-942c2b6e1061", "sighting_of_ref": "indicator--b9d0755f-3c08-4ccc-9403-616b9176818c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--278005b3-c907-4326-b592-edadc48bdb61", "sighting_of_ref": "indicator--0edaee7b-b775-41f9-8f08-2edf5fdbf072", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dbd094e-b1c0-4bcb-8bfc-dfcd9eeea54a", "sighting_of_ref": "indicator--fd530d40-86ff-40b2-b598-e119babfc9a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7ff721e-a7b3-4c3e-8431-be5c31f46b97", "sighting_of_ref": "indicator--cd1ead58-fec9-46ca-9164-be5d325a865f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb2063e9-0a6d-43f5-a812-e3b1d083f7f6", "sighting_of_ref": "indicator--87ed6a71-0bb1-4851-bf79-a09cf0154bdf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d30a90b-77ef-4412-b206-36095b5ad7d7", "sighting_of_ref": "indicator--0d9e267a-2f3a-4e5d-84eb-9c3808d43b95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4df0f66a-9e76-4da4-ac15-f151002eeacc", "sighting_of_ref": "indicator--5791603b-deff-4705-93d5-2668d8243e06", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0102a997-3ce3-46c5-a754-68387338451b", "sighting_of_ref": "indicator--275b2a39-8454-4df9-8d59-060d3956e6d3", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b030b6a0-b80f-465b-a5cf-e44de7c9be92", "sighting_of_ref": "indicator--0602fa84-345b-44b1-83b4-7199372da20f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f90cba96-4448-43ee-a472-1611b6af6a63", "sighting_of_ref": "indicator--6b32778f-c385-4454-b01c-2061071e63f4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84aa02c2-651f-4aa4-aa43-279635c8fdf0", "sighting_of_ref": "indicator--b4cb8aec-be89-4cca-9af4-2024b2584e53", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8989f3d-5a82-4cb4-817a-068bd062f9bb", "sighting_of_ref": "indicator--3135d518-c773-44ff-8f1d-a5f4bccd9c93", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50cf2b00-4e5d-404a-9be9-cc1edbb25b8f", "sighting_of_ref": "indicator--b0e02ac1-6ea7-4628-8c7d-4ce6b783ad2f", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc3d555-7291-478f-91c7-25149c5e34b4", "sighting_of_ref": "indicator--d4bcdabe-fb18-4bbd-a785-a52ff672fb29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eca8c820-773d-4443-8fad-d04bd6640ee6", "sighting_of_ref": "indicator--b8af1754-8746-44ef-8747-c652e357ccf9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0795b122-059a-43b1-93dc-54cbae4e83c9", "sighting_of_ref": "indicator--cc841294-7c24-4f7f-ac96-2a79e6f61814", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1af24d4e-b61c-47f4-86d0-f234e5edb316", "sighting_of_ref": "indicator--e5eaae57-0199-49c1-8c00-0a70befdab95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f8fbdb9-b418-4400-b362-437318580dbb", "sighting_of_ref": "indicator--67667cc6-c55c-4af9-9950-90a6ffd2fe67", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c280d62-d312-4f97-ae98-675108e6fb4f", "sighting_of_ref": "indicator--da35cfbb-6ee3-433d-a8b5-0d2bab1fdeb7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e9be951-5424-4dd4-99d3-51e8aed2da48", "sighting_of_ref": "indicator--b97e8fc2-142c-4323-8af8-cafc4573da9b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccfd8ef8-ec60-4e1c-bd63-b8df57694ef8", "sighting_of_ref": "indicator--d64c207c-eeab-45df-b57a-f970fcb0f82e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0855671b-a637-4895-a417-1d26f10f0fed", "sighting_of_ref": "indicator--f0026e03-6ccc-4b74-ad0f-d235daa334eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--086cc46e-7ed7-49f0-b632-7cfbb5611a41", "sighting_of_ref": "indicator--018a62b0-2f45-40ce-a316-ff62328d7fa7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e68bc38-b0f6-42e5-b720-cf4948a9f62e", "sighting_of_ref": "indicator--6fd0f538-3cd9-470b-bcc0-a3f4a59e5f90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184d0f29-7c8c-4115-a105-75cb29298fed", "sighting_of_ref": "indicator--75464c17-da67-461b-a99b-d68315cb7efe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa10e8b5-f50e-413c-b55f-5d21f36857ce", "sighting_of_ref": "indicator--71c6c1ab-8f25-4099-a44d-0404a08d0d35", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d2cfcb7-a058-497c-9fa9-f0b7d79d9fc3", "sighting_of_ref": "indicator--8c9fb84a-7df8-4d0a-8bb4-846d0a85803a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc42caa-ad33-47e2-a671-e7986849b0dc", "sighting_of_ref": "indicator--92700430-753d-4a55-916c-d85d784dbd95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53536a8c-5522-4e2b-a1ff-74472e98aa96", "sighting_of_ref": "indicator--824a6954-c0ec-48aa-a47b-68edb2b1628c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c022277-926b-47e3-86e9-ddd123e12274", "sighting_of_ref": "indicator--9efeccbe-3c6e-4f3c-916e-1bb0741e254b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d655134-2c77-4f04-8758-c15eb24b5b71", "sighting_of_ref": "indicator--d4b34a5b-b5ad-41a1-b8d6-df2072ce3a22", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f89e1549-349f-45d8-856e-187c40045d19", "sighting_of_ref": "indicator--57414713-1bd4-47c9-9cde-2442a2af0ced", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66a5b137-d5e1-4ff6-a537-ed1a2eada498", "sighting_of_ref": "indicator--8c518d2c-9606-40da-80de-fca1de137265", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49778cff-19b0-43db-9009-00f78e9ae097", "sighting_of_ref": "indicator--80c50939-b955-4555-84d6-c0f4f974d42a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cfd90ce-0022-4b41-9645-0d232156ad19", "sighting_of_ref": "indicator--9993de4c-3f7e-4d20-aa26-2b361282eed8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6a0ebe0-96ac-4f98-951b-7b06545c9052", "sighting_of_ref": "indicator--ae5033e0-6a37-4a41-94dd-668a7b9860fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aefcb380-a3d0-4814-a19e-7b2f4c2e40ea", "sighting_of_ref": "indicator--62ab3676-1f32-43a4-bd8b-af6cf95091e2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--307d4b66-bbb8-46a1-8672-6a52bea1bbc7", "sighting_of_ref": "indicator--c616cacf-e2e7-4546-8d1c-c49eade7d362", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db88d001-b773-4d84-a4fb-de1b315d8f9e", "sighting_of_ref": "indicator--17c3a6ae-de4e-4c2d-848d-08af9a72b4ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4078e974-e7fb-48a9-8354-4d1238689b98", "sighting_of_ref": "indicator--d0b15fdb-0664-45f9-9935-e95674e31b86", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--767bebac-4835-4d5c-8e6a-652f385813cd", "sighting_of_ref": "indicator--f913a1f0-919d-4566-ade8-1d0c109a59b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6570412e-7bf2-4a86-b840-4412dda09407", "sighting_of_ref": "indicator--ec0c45b7-d35b-4e0e-a733-b870af22477c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--657c0622-362e-4892-870e-4535c55880c8", "sighting_of_ref": "indicator--dba91ac6-7254-4a94-9e1d-db93ea03c546", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66736dd9-919f-456a-8e11-74e2ee924161", "sighting_of_ref": "indicator--30258be1-413e-49d4-8051-3adf42fe8895", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01504d0b-1399-486c-97c8-68778920cbba", "sighting_of_ref": "indicator--e5a411f3-c00e-4458-a116-f70f8b811a70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc191b08-214a-4bea-b0db-e08478fbc449", "sighting_of_ref": "indicator--8e4f3fdc-2fae-4423-9f5d-c78956958e76", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bd56207-2a82-4882-8346-bc231db53ada", "sighting_of_ref": "indicator--5aaa1eea-d22f-44a5-b2dc-f0ff67142021", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f78b2cc-21e7-4bd3-b02b-6663101d9df5", "sighting_of_ref": "indicator--36ab2aff-6241-4d92-a728-d0521f945f45", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34796400-c807-4249-baf5-f1e1859ba079", "sighting_of_ref": "indicator--f3cf4ebf-0375-45b8-b329-3eebd2eafa14", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5b94d4a-df9a-4798-965a-b8bf3f98827f", "sighting_of_ref": "indicator--3b993614-bf0f-4b3b-a3a5-d2b46a843954", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43a65d0e-74dc-4e3c-8274-575831098be5", "sighting_of_ref": "indicator--8002a538-f537-480c-a5c1-d2d07c4b6739", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d869fda-d257-4e20-ad43-c5c0bbba3100", "sighting_of_ref": "indicator--f5977bef-50d1-40f0-8249-f2fdc04a7db9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16e15553-2903-4b53-80f0-7d3d16ecf22a", "sighting_of_ref": "indicator--7c252437-bdd9-4270-bb59-d5b9cb6b3731", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--410e32d2-a998-42de-8dcc-b02410088aaf", "sighting_of_ref": "indicator--239fcb30-4388-4937-bd67-9de7566fd96e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb24d2f5-0aac-4b6a-8bb7-e3b8e271e731", "sighting_of_ref": "indicator--525bef1a-1fd7-4f1b-8d44-39686d745c25", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30c9eb38-6001-4c2c-a5ca-ed98acd3bec3", "sighting_of_ref": "indicator--d3f90b7c-7d65-48a0-9d61-7524cc3e844f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bbcbbbe-130d-424e-b984-82a514b894ad", "sighting_of_ref": "indicator--8bd94530-7166-4bc7-a217-f97f1b486e0b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40a6805a-0bdf-4ce5-9313-8677e4d3eba1", "sighting_of_ref": "indicator--9f69b89b-0667-4aee-8fc6-2a2113ea4b4d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3eb7f84-147b-4a47-b44c-04e4cd1b6f0d", "sighting_of_ref": "indicator--e1208cee-830c-4cad-8a23-3504f4bb597b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4762581-6284-47bd-8ae2-e25dacb30edd", "sighting_of_ref": "indicator--1b466789-9534-4912-a0ef-d00334f5e6f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82b89848-aeb5-4925-baf4-3e63d0217885", "sighting_of_ref": "indicator--42216151-4115-4e2b-9154-731c2998b4e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0970b832-cbe1-4991-b30c-cb000fde249d", "sighting_of_ref": "indicator--6999449c-9378-4c50-a180-9a7bbe7c460f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0f32106-cdd3-45c3-b0b9-0bf63f1f7be3", "sighting_of_ref": "indicator--72df54b3-efa4-4765-81e5-95b055878eab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9c5e313-aac4-4604-98c6-22a250fd7f01", "sighting_of_ref": "indicator--7ce52094-c269-4fc0-b928-1378eca5ced3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d780cdca-6452-47cf-858c-0c3ba9a40494", "sighting_of_ref": "indicator--983a62b9-7601-436d-b9b3-51c2c8d90f96", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e19377b6-5f82-4a0b-91f7-f950a19930b9", "sighting_of_ref": "indicator--07da5971-c450-4caf-931c-d5d336904e3d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0567573f-ce2c-456e-89ae-e679236f8db6", "sighting_of_ref": "indicator--e33497f8-03a3-4651-b481-3f0d7ce92e5a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b17be1-2f5f-4966-a422-9bc14f2924e1", "sighting_of_ref": "indicator--f601597b-ce1e-49f8-98ff-361f25bbb454", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec94ecca-c6b8-40f4-9e43-1626253da466", "sighting_of_ref": "indicator--87a08e5c-f2c3-4b3d-907f-c78c3df87305", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77ff3668-e8a4-4278-b458-c380ea9238ff", "sighting_of_ref": "indicator--c401be5f-b6c7-4df0-82f5-b2475172c5e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51292d2a-8eef-479b-863b-9e7f721452dc", "sighting_of_ref": "indicator--541613f9-87da-4989-af3a-37c592154e2a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21f14212-2c25-49c3-becd-ee2e0fba9119", "sighting_of_ref": "indicator--8ed299a1-ae41-434a-b5dc-e7bad01bb395", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cdbfd55-4b39-437a-ab0f-566d42550340", "sighting_of_ref": "indicator--8debc819-7d3f-48f9-bcd7-93067dcd3af3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eeaef56-b8f4-409e-802c-63d9baa63785", "sighting_of_ref": "indicator--672aafa4-a419-4771-b83a-eb9afba5bb25", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6b4aad3-fa11-4ff2-8a4b-5f87bd40de7a", "sighting_of_ref": "indicator--a943d3dc-8701-40c3-9edd-32f1ba732473", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4acf515b-f32c-425f-aaf5-046a69ef6435", "sighting_of_ref": "indicator--87088714-2d38-4f07-be4a-e484312b65eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3357bc26-a261-4c88-9353-4cd3033499d1", "sighting_of_ref": "indicator--2bbb3bb1-d858-4688-8275-a95a9454826b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc28897-de66-4e0c-85f6-5d5bba4c9df0", "sighting_of_ref": "indicator--796008b7-17d0-4ea0-9f69-f0f5b02eaf9a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bafd3245-cdaa-41e9-88d6-154cc3fe4eed", "sighting_of_ref": "indicator--754baadd-2d20-4e98-aeca-c8245f4cf660", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45084b31-d4b1-4b31-a935-963e249bc98f", "sighting_of_ref": "indicator--94bbbba9-8cb0-4843-b47d-6a088ff27094", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28e13902-129b-4cc3-98f7-a90da09faba3", "sighting_of_ref": "indicator--cc1f6fa7-9a06-47f8-85c4-e53d58ac762c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--859c68e3-d0d4-4056-8f3f-8e3aa532100e", "sighting_of_ref": "indicator--38bfdf3c-13b5-4225-badb-f73c589123f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b5500b6-9f9e-4768-a313-75ac847529d0", "sighting_of_ref": "indicator--91a5b888-a20a-4bb0-b372-37848bcd6ab1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffc3b3c3-823e-4359-a4b7-b8249f5d5485", "sighting_of_ref": "indicator--cd54b1df-2fae-4203-82cb-e8031641f110", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef224a69-33e5-4c49-9698-a5344da43b52", "sighting_of_ref": "indicator--a70ec9d6-2e23-4278-b4a4-7e2dc73f3a62", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d18f813-b030-4fd1-a61f-4b40a4f3090a", "sighting_of_ref": "indicator--1c8ce3de-e0a8-47b1-8c80-fd9b7d765099", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e587a73-7bd2-4f7f-a846-8ad574fab7ff", "sighting_of_ref": "indicator--0b2330df-ebd5-46d9-8dc5-0ebb8c3254e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62444938-ddff-4d24-bbce-20ab391d36b1", "sighting_of_ref": "indicator--54e97c99-b8c6-4638-bb37-cafaab7df193", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3bcc7f4-953b-46b8-8f12-f341fadc8b18", "sighting_of_ref": "indicator--c818378a-692c-468a-b7d3-b58a7a75c2d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b45e68-91de-4b71-9094-17b939b590c8", "sighting_of_ref": "indicator--590483e7-12f5-4585-a750-95c0253f4854", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--641ab751-d97a-4b4d-a6b0-c834d932c020", "sighting_of_ref": "indicator--8264fe5f-98e1-45e2-b8f5-d066a010f071", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3e79c40-4e5d-4e9b-a104-2003b604b440", "sighting_of_ref": "indicator--d0949b59-86e4-44ca-8ee0-e1b34d06c91d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--268da865-764b-4291-8d11-f42f6fcbfe6d", "sighting_of_ref": "indicator--42c26e3d-78dc-4882-9f22-11a08800ea8d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbb11d39-b812-48c9-90a7-9dd3338a940e", "sighting_of_ref": "indicator--ab0cde47-47a8-4247-834d-d25566f61e69", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54816cdd-ca12-4680-b86e-302f2190992c", "sighting_of_ref": "indicator--19cc9d0d-1266-46dc-a479-570441ed2b4e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--affb9e46-c7da-40bd-9dcf-404a62357212", "sighting_of_ref": "indicator--f521edb0-bc29-4d14-96bd-4297b80177b4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--670b8f6c-6428-4bf4-b3a8-df21eafeb3c2", "sighting_of_ref": "indicator--fb6aa49d-94bd-4a05-bdd9-a99312217556", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dafca2a5-7ce7-47fb-ad91-f5a327c9e635", "sighting_of_ref": "indicator--c20bbb40-921c-4b4f-9d66-7b282b94af64", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a09ed067-6c1c-4433-a2d4-276eb3321ae4", "sighting_of_ref": "indicator--6842296d-4b44-45da-98de-77527f9efa3c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46fc879c-734c-4e4b-95d6-5d0a380d0d71", "sighting_of_ref": "indicator--42e3009d-e4a5-4660-8553-c5a9a055a011", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96ec51bb-efe2-4c12-a66a-81be0e99b5ff", "sighting_of_ref": "indicator--3df7d132-a548-48b2-a188-3eec68a4c725", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e369c053-ec40-408e-9447-b3e200b2983d", "sighting_of_ref": "indicator--2ba82e93-a8a9-4aa9-99ad-e2d3561a7051", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71d39af3-bf12-48d4-bd7e-a512e79a0061", "sighting_of_ref": "indicator--2eff6163-5cac-41bf-8170-183b8b1d7473", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46685607-37e0-450e-b6a7-a868092cea47", "sighting_of_ref": "indicator--69d49fbe-0a01-4217-af0b-3a976e74b083", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ced9f05-c0ac-4117-86df-f1c2da61a432", "sighting_of_ref": "indicator--dea59a6e-ce77-4881-a158-8b2bd18575a3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4649eb47-8fc2-47ae-980a-15cc082d6313", "sighting_of_ref": "indicator--4102e357-b6c8-40fb-9dbf-695741cdf0e1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac912151-35a8-4672-b070-5fa73fd4e823", "sighting_of_ref": "indicator--554b22fc-db24-4b7a-aa68-b3421788e279", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94a7566a-552e-4397-bb4b-9f9a7f8f9825", "sighting_of_ref": "indicator--ddc3af7d-e451-4f42-a89f-56924a016ead", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef97f087-cbae-49bb-b46e-4c8a826fb514", "sighting_of_ref": "indicator--c6350f8b-fb78-4126-94b7-74b2f091f3ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3ae7596-cc1d-4e02-b2c7-1562f6361a62", "sighting_of_ref": "indicator--eb35bf47-97ec-4295-921f-ac2de33d5263", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b30c401-e907-4065-bcfa-3e02ad826b3c", "sighting_of_ref": "indicator--e6f12991-6bf8-480b-b016-1c4c3d9b6735", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b31e9dba-0ed6-441e-b480-987ed234c3aa", "sighting_of_ref": "indicator--5f09ddcd-8e07-40e9-ae42-19fea9287a84", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--877ed3aa-eee1-4702-be4f-c0cb45720078", "sighting_of_ref": "indicator--f3295fc4-b4de-40a5-8a39-5ebc18649f73", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--528fe26a-8a2c-4cd6-a81e-883f6c1bed41", "sighting_of_ref": "indicator--6e0cbe4f-3a0a-4f53-8eab-78f1acbbaaca", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bc4f050-6060-4f79-bebe-f61bd4d191fb", "sighting_of_ref": "indicator--fb0543d7-dac7-4018-b626-907aa0d815fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e96b0ab-bb1e-4960-a4ef-5156ae84a7d8", "sighting_of_ref": "indicator--1839c78f-4494-4db6-89f7-07c4a497b4a5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2ea2ca5-fa59-4094-b5e3-8c066f06784d", "sighting_of_ref": "indicator--3c3812dc-aaae-4c4f-a7ef-c036a332bae7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f412e60-8b15-4051-8357-02caec916c0a", "sighting_of_ref": "indicator--e8cac18f-8ba6-4a6c-8e67-562e7fb8774e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3e081a1-2066-4431-83ec-9994c4972b3f", "sighting_of_ref": "indicator--ecd73a6e-9ea0-40d0-9d1f-9933fa03d358", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e42a9182-efbf-4670-8fb1-535052e2b527", "sighting_of_ref": "indicator--d97066d8-ea1a-4e88-8a26-a0fa2f17c0f0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db00ba0a-92c8-4387-9ecd-d6dfb12a00da", "sighting_of_ref": "indicator--cbc8f01a-7c9f-42c0-bd79-b0246d95c005", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f61ebbcf-7088-43b9-8f91-c5d00e9ef232", "sighting_of_ref": "indicator--e66526e8-a222-44d1-a611-18747744dad4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d83bc749-3790-40a8-aa82-a79d235a9b74", "sighting_of_ref": "indicator--ae0c68ca-f4a0-4cce-9df8-77b2b78df081", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e4b9ce7-4bf0-4927-971b-3243b3a9caaa", "sighting_of_ref": "indicator--ac1d5e57-d270-460a-a4c7-46100bcc38b5", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99edeed5-8ed3-4617-bd12-968ccf2ac35c", "sighting_of_ref": "indicator--1c2241d2-13c3-40ec-bc58-5aecf3ae474e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7738ef8f-a57b-4197-afcc-cbb73a21b342", "sighting_of_ref": "indicator--1076624a-6d13-4d6d-abaf-dc177fedef1d", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--555a118b-0648-4389-87d7-5b2a3d7b1a36", "sighting_of_ref": "indicator--f2be3226-7100-48fe-9744-172fb1b16967", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfa0f547-ded0-43b1-a5e0-6fda516ccee3", "sighting_of_ref": "indicator--b77430f7-eeca-4697-ab63-779b88011cdf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--039a5ff3-527e-4f80-803c-6387f81bd809", "sighting_of_ref": "indicator--d674c669-f51c-42fd-ba2e-5c3faf36d17f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d348778b-95f7-4c32-a8b2-0e04354f17cd", "sighting_of_ref": "indicator--ea8e81f7-e872-4976-90bd-a01ec60204b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33c7f187-b961-4ad4-89f3-5c7caa0fe250", "sighting_of_ref": "indicator--022837ae-8167-4ffe-809e-e8fe76b19d32", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5af5cdfd-aa59-40c6-8457-816d251bfc82", "sighting_of_ref": "indicator--3432c5bd-0db7-499e-8356-9de1d6b5305b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86447833-3abb-45fb-89b6-94e9ba1c75bf", "sighting_of_ref": "indicator--3624358e-1e5d-465b-9304-a3a56b1e398b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72564024-9be3-4b19-8386-931355f878f2", "sighting_of_ref": "indicator--d4dc51be-c7ca-42c8-8298-e03fa06b9ab7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56107e29-5326-452d-a64e-c8c16e810556", "sighting_of_ref": "indicator--f594981f-60a8-4dd1-b188-d94cc878bab0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--025db390-4923-4007-aed6-8042baf18312", "sighting_of_ref": "indicator--7241bb68-1782-4504-aaf9-b8eabb681a26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--001945ab-721f-4ce8-a3c2-f1ae327c6c34", "sighting_of_ref": "indicator--22ba58f0-7569-4a7b-96de-d6fe5b99a248", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3998475-f4a5-4260-8bc4-e864480ef3ac", "sighting_of_ref": "indicator--c3288b32-0279-4a57-9dca-6cdda180c6c1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--737485ee-318d-4deb-b998-51155bb5cc01", "sighting_of_ref": "indicator--2f841780-b483-4a78-8c06-f525f71d12f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c09f974b-e959-48ce-83a2-adfffa0bfea8", "sighting_of_ref": "indicator--681e997d-502e-4330-92c3-a8192ea91bb5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1911512-f431-4605-9f0b-9c82faa6296b", "sighting_of_ref": "indicator--21e30c7b-a329-4c97-b702-e04744459975", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3cbc25c-f951-4f46-8495-898a96410883", "sighting_of_ref": "indicator--78d3e53b-2654-464a-80e2-91b098c29788", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d39c311-e46d-4612-896a-0f1f86fa3f35", "sighting_of_ref": "indicator--eb2cb903-74d5-4c52-86bd-3f763745931b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b34fa63e-d4dc-45e4-99ae-be689e91af0a", "sighting_of_ref": "indicator--09fe448c-b42e-483d-aac8-7dae1b430a17", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef99c7bc-b7d3-42c2-95c8-aba0e7017db9", "sighting_of_ref": "indicator--ed394c0b-33b2-4d13-82b2-676c393823e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5e48326-2613-473f-a522-0732ac269850", "sighting_of_ref": "indicator--7615bcf9-b080-4500-b2c5-3fb6c0514fb4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e26ec89f-bb53-4c69-b3d7-2ee7cf9f1bab", "sighting_of_ref": "indicator--0b42210d-aa6d-458c-9ee3-cfc404acb780", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0820674-1188-4350-8929-73bad1379ffa", "sighting_of_ref": "indicator--1fc7b584-3a9f-4aa6-8cdb-adbff27b0fd0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eda09ce1-1b51-4292-ba1c-1ce9176915e4", "sighting_of_ref": "indicator--4c2158ab-154b-4f00-af40-baea05fd9132", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7ab97de-7b35-4c35-9e3d-012b7d5b77e9", "sighting_of_ref": "indicator--f41bf254-9fcf-41a2-aa84-24cc3cff1205", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9ae3d0b-168f-4643-8a8f-c82f1a411593", "sighting_of_ref": "indicator--72115934-4ebc-41d5-bd16-b0bb0c7969ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1467c4f1-4163-46d9-9cf6-b570afe7fce6", "sighting_of_ref": "indicator--72115934-4ebc-41d5-bd16-b0bb0c7969ba", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e908a765-3a1b-47d0-a993-af0a0af51d13", "sighting_of_ref": "indicator--f79dd9aa-d977-4ad8-8aea-7a24d91d5794", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dbc5b7d-739f-4564-9511-04f42e2c7d1c", "sighting_of_ref": "indicator--d66a4de9-f9e8-4a97-b54b-a5dfbcd61fd2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--053493e7-905d-4c75-8a18-9514690a00c9", "sighting_of_ref": "indicator--ff980758-e883-47a0-a6e8-515bc1f0c866", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--907356e2-fd6a-4a77-ad96-ae22ec5adea0", "sighting_of_ref": "indicator--d5f1a713-a48e-4c7c-b80c-de3aa73bcfe8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be3e4efc-64b9-4444-b641-a1f3a6a03a0a", "sighting_of_ref": "indicator--205db2a3-9dc9-4a5d-833c-b42fe67c0226", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b5d60f7-8612-4771-a481-34e6ae5e297c", "sighting_of_ref": "indicator--189ad14e-4778-4d69-9f7b-3482d7b73906", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eca6ce2-0c43-4a06-b0ed-ef35bb27233a", "sighting_of_ref": "indicator--85abaf5c-eb29-48d9-8c12-6cf1e51457fb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f699510-34ba-4fee-a1ab-2cae6fc68d3a", "sighting_of_ref": "indicator--0fce9ae9-b29d-458b-ab9d-b5f1a0e6d568", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73b16879-16c0-46c1-804b-656b0b4c83bf", "sighting_of_ref": "indicator--abb164fc-34d4-41c9-81e8-1dde6703fe7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa02b9a9-6212-42c9-9c08-45455b0f3d6a", "sighting_of_ref": "indicator--bdb9b4c3-3789-44ec-b0cd-0592dd3bbd52", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28433bae-d9fe-4874-b1d7-1d51f2f20ff6", "sighting_of_ref": "indicator--3373faaa-86b1-4dc5-ba6d-08402307c6ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd729837-2d11-42a7-ae8d-e5395ecaeb6e", "sighting_of_ref": "indicator--3f95aba1-ff3d-42f2-ae27-7c7009d36d3b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d7742a0-bdd2-4b63-9e1f-e25917546829", "sighting_of_ref": "indicator--d7c88eeb-e7c5-4ca3-8c23-f0ddcf33c812", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f63975b-3ec1-42d4-9e19-73bfaba1c5f3", "sighting_of_ref": "indicator--1982a2a6-e961-4df2-ad08-6c0c68b7d5d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--311ab05d-0120-4d99-8da8-ddb7fb6d436e", "sighting_of_ref": "indicator--254b6df8-b08b-4dfb-8fca-cf883afab1d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--064ba5c9-1bb4-4f62-a2d9-a6cd59d14e90", "sighting_of_ref": "indicator--84051fb5-2f14-4846-bc71-12a515b7ade3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--444bde03-09fb-483c-acff-85bccf0e6765", "sighting_of_ref": "indicator--ed01cad6-1aab-4d8d-a69a-51f1b0472ab2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a66366d4-0e5a-4288-857d-8ac670184fdd", "sighting_of_ref": "indicator--2b534d9c-cd13-4813-90d5-0a377a8d740f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aa1d6f3-dcef-4466-a956-1b1d62a1783e", "sighting_of_ref": "indicator--f7267186-3dde-4c55-99b4-942859c495c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ea62bec-7f79-427f-b5a3-bdf1efbf9457", "sighting_of_ref": "indicator--a8661379-eebd-4906-a94b-7932cef25639", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9749fd16-0dac-4c8e-9451-3d0b8541d678", "sighting_of_ref": "indicator--3149b6a3-bbdc-4897-9386-08c707136ca8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c47e3e09-8357-4902-873a-6d2c6d17d325", "sighting_of_ref": "indicator--f38504fa-1a48-4aec-80dc-21cad88a24b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f0c123c-05da-43d9-b368-29c954c6bf9c", "sighting_of_ref": "indicator--9c3d4f38-a99e-4e2e-aa2c-b936d5232e75", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c3a75ac-44dc-4a49-a04d-9279a7a761fe", "sighting_of_ref": "indicator--1c4bc376-4a0e-42ba-ae50-40b604ddb254", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6c44c7b-e17b-404b-8f2f-3282d57788c4", "sighting_of_ref": "indicator--c9f71cfb-a317-4fa5-b035-ca4fbd8a9582", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4531e82-1c03-4d50-b988-d24975391fbe", "sighting_of_ref": "indicator--a878c5d3-8834-46db-a799-41dceefb3d04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91ad5e88-b7df-4a08-b504-408161cf3c03", "sighting_of_ref": "indicator--efe3ec43-3dac-4abc-a5cb-7c53dea9313b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--813f84b1-4344-4592-bca4-9d483f320f23", "sighting_of_ref": "indicator--324acf69-5fc9-49e1-9229-2636a029113f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0412b87d-1e80-482e-bf30-21b6625ac6c3", "sighting_of_ref": "indicator--ed52a6b1-b8cb-4f10-a274-fdcad9dc2067", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe59fcc5-fac1-4e6c-bd8e-f71d3c86e412", "sighting_of_ref": "indicator--2a5513f4-0ade-4ebc-9cf0-418bbd4b52a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5125eca0-4e1c-43f4-b66c-cc72102d2dfb", "sighting_of_ref": "indicator--9551a54f-4ea4-4a6d-b2a2-9cbf92b03753", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--781ce000-1582-4908-b558-59450ef11d0a", "sighting_of_ref": "indicator--d739e62e-623e-4507-abe5-5a5a8b3800cb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c56a51d-1ab8-4590-aa1f-401bdca1cdb5", "sighting_of_ref": "indicator--f08a3b34-aaba-4114-9e95-e94ae5cf3be8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe88d8a8-f1ab-4500-92dc-1e7a0f4237af", "sighting_of_ref": "indicator--9f9f586a-d78a-406e-9c49-8fe0434844ea", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25f5700f-f1c6-4963-8873-f5305e5d5ed0", "sighting_of_ref": "indicator--3fcbb345-2683-44b8-aab4-8ea6fe6d1d5c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c57d8aa-d59a-4973-b858-7583e7d2d22e", "sighting_of_ref": "indicator--68e4b591-b399-40b7-9289-7319b2eae22a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccd07dd0-4e9f-4e45-926a-355413ae5e32", "sighting_of_ref": "indicator--aea157a7-972e-4b73-80e7-6744395623bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9112b8dd-689e-4d13-b643-c30fa4558ce2", "sighting_of_ref": "indicator--32b20927-291a-4778-b95b-0f331f8cc68f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27fdea44-e538-47de-9c27-f9423614fa31", "sighting_of_ref": "indicator--e07accc1-cf36-4482-a082-dc5e6619b00e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4e814bb-3661-4efc-97d3-d2bbf711893a", "sighting_of_ref": "indicator--9d98d0c9-d7ce-4738-981a-5a3df8bce15f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66a7056d-4601-4e67-8ba7-f56ac5283e82", "sighting_of_ref": "indicator--9431273e-dfd2-4540-89ee-04e9272c1b9f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f66849b2-bd8f-4d3d-b857-cf6c320a5a3d", "sighting_of_ref": "indicator--48c8b3b4-668d-4565-810f-3d14ae7bcd0b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0682e16f-968f-4599-ba85-88b2cff5b972", "sighting_of_ref": "indicator--a146d82d-08c7-453b-9cc3-e5fe83a65ba2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--665eb2e9-d182-487c-911e-d2c31a58cc17", "sighting_of_ref": "indicator--47e08287-fc5b-46fb-93dc-3e79590d1d59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b89a8de6-59b2-4cbb-a325-6d99f3084486", "sighting_of_ref": "indicator--b666484b-e964-4a3d-8636-65535508556f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--811ab7d8-708b-4a43-ab66-87023b131862", "sighting_of_ref": "indicator--3757d4ed-2734-4334-b0d9-f373da60b7e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eff5fdd-8ba8-44f0-813b-2f8dc7945b1c", "sighting_of_ref": "indicator--b0120599-688f-41b0-a526-d1448d9d87b4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e33ea43-2781-41b7-869d-f8e4f00b1d94", "sighting_of_ref": "indicator--68a7fa4a-91cf-4db7-9aa5-1f45f63e9dd6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de531a5e-f7bd-4429-b96d-6890e498bfa2", "sighting_of_ref": "indicator--030688b7-f69a-420d-97d3-a24b3cba6c6b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c31f142-25d2-46c4-83ea-b86993a560dd", "sighting_of_ref": "indicator--455abdea-addf-4705-8162-491e8d4146f0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1268f555-c739-49b4-8d7f-7cb3a309f369", "sighting_of_ref": "indicator--bfbc623b-05a1-445e-8fdf-322bfb14b1a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd88d241-4c8a-4916-8294-0b577e986d30", "sighting_of_ref": "indicator--f0559259-e73e-4c7c-ba98-4010500e3052", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8439dce-ac2c-4567-88fe-764f8f98d025", "sighting_of_ref": "indicator--a3c2ddb5-a87a-458d-8a17-a74a29343802", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23113618-cab0-455f-ac80-234fe96bd21f", "sighting_of_ref": "indicator--80952aea-14fb-419f-b0bf-0f4486e8d8e2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--177baea2-29bb-4fee-948f-c766dcfac321", "sighting_of_ref": "indicator--e88429a6-3b0f-4c58-bc39-5716d599a356", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--011a24ca-32ed-4daf-a3a5-84783ac1ade6", "sighting_of_ref": "indicator--5c1b80c1-40f7-4e71-ad2a-551a5add953e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a9f3f5f-0ae4-4402-a3ba-17381ee565d4", "sighting_of_ref": "indicator--6f5c4d59-3ecf-41ca-8580-98aefa61e76b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0637a47-4eda-4754-944a-914e4f334d23", "sighting_of_ref": "indicator--8eba7058-fbf4-4d09-96b2-989db3e58b0c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51f9f778-15b2-4418-a977-34b662857a2c", "sighting_of_ref": "indicator--2a038ab9-e567-4c43-8cf5-8018594c1fc7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a0ae6c0-6bd6-4a80-9a35-c06b0e2d2460", "sighting_of_ref": "indicator--6d753c2e-f476-4df2-8316-b266069d4f63", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c5a9fa-1ff0-4ac0-a3d6-aefea3569755", "sighting_of_ref": "indicator--9ecbec1f-f7f1-44af-876e-638aac3b9fbb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b409de0-f32c-46cb-9f3c-a79594b7ba4b", "sighting_of_ref": "indicator--e4a731cd-5789-4b9a-8aad-713eb571ef16", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9535f249-2264-4ac2-b812-eefefa12b535", "sighting_of_ref": "indicator--70360dac-750a-4991-80fc-1077f359ef3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98c8fc81-c75c-437c-a0ac-5bf3d3efaca6", "sighting_of_ref": "indicator--758ac1a3-c0d2-42ac-afb0-8c377346a450", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--448e47aa-e07b-4d72-a94d-74dfe5489934", "sighting_of_ref": "indicator--d93bb361-b4a4-4a74-80af-5b3fc0033983", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cab88976-cef0-4feb-9213-1f05581fa414", "sighting_of_ref": "indicator--27f48625-0ee7-47b1-9766-bf2b026fb69e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7172bd38-c0a2-48d8-9c77-94d6455d6411", "sighting_of_ref": "indicator--1f73dceb-f87c-4e51-a0a1-b3591596c720", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a068e03f-71ad-4d90-9e83-a4c3b687d74e", "sighting_of_ref": "indicator--39286495-3d28-4b7a-abe5-037dbc75ef84", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--999fd6ca-a121-42ec-b102-8b8b5abdf373", "sighting_of_ref": "indicator--e7567796-27e4-44e8-ac00-8272c6dae934", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c3a248-803e-4c34-8558-60637b5d1749", "sighting_of_ref": "indicator--ca0a189f-567f-473a-a918-553878d49b13", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0032d8b5-d865-4329-8cfe-426c8f7bc68b", "sighting_of_ref": "indicator--fe7a2847-f940-446c-a9ea-7ca40e5c3de0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d85356f6-51c6-4880-8c39-0ca6c6b4a0c0", "sighting_of_ref": "indicator--8a2f7a9e-5272-418b-9c7d-d5b03b71b4d6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--444f2d0f-5287-4428-9b00-2512f228ce45", "sighting_of_ref": "indicator--f5a7345f-9d0c-4a07-8154-c3d121d49336", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29f4eba3-1c30-4947-87a9-216626180931", "sighting_of_ref": "indicator--10c87911-5c58-4a78-a6c4-f6c0ab0f0138", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80e499a1-a681-40b2-96a3-6d2e7967057c", "sighting_of_ref": "indicator--55fec52e-8f5e-4c25-9268-6c89493209fb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1ed2cc1-6e3a-41f7-b4d0-b3a54a2a3ee7", "sighting_of_ref": "indicator--cc81ddb9-09ec-4a7f-bcc5-d12dd8fb3097", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff39436f-f665-4ef4-a41d-ca26078a2dad", "sighting_of_ref": "indicator--bcafb6f7-340e-4894-a052-e15847a96877", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--644f1e0e-00f1-4980-bd96-d85c6ab6f770", "sighting_of_ref": "indicator--3b898534-2e8c-4d39-899e-916fcd61e9b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d1ccb76-b647-4f5e-ba13-b09734507b82", "sighting_of_ref": "indicator--e53a344d-45c8-4611-aca8-9121d5e20399", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbe17af2-3a96-473f-a62c-341b4a36c305", "sighting_of_ref": "indicator--11ce32ee-aeaa-4745-8a5d-5ca825139ace", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffe4f0a3-7f16-4150-97f4-4607d7c68688", "sighting_of_ref": "indicator--a2f1f4dd-887d-41eb-b314-507f954aba78", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d5c8ec1-eb1d-410d-9ac6-37043efffc98", "sighting_of_ref": "indicator--7af2ed73-4101-4697-a6aa-5913e50182f8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07f5eb83-7be8-4bfb-82a4-a7fc17a447a2", "sighting_of_ref": "indicator--44bf49d5-5205-43b4-b7bc-b4df765ebab7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23486ccd-c3bb-4ddb-a3b3-1a7426eeb409", "sighting_of_ref": "indicator--15e0ff45-bc92-44fa-ae24-1537c32cf2e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--077cc122-a48c-48df-99f2-e16ee0c563c2", "sighting_of_ref": "indicator--e96b8292-a393-4d48-9286-cb4f7974d8fe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--140a2122-e622-4837-9fe2-662d7e088d55", "sighting_of_ref": "indicator--133ee5c1-8963-4c65-b9da-fb6644243292", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ef0c379-05bd-4fb3-adad-d53f34bc0107", "sighting_of_ref": "indicator--1728935c-47c9-4f2a-80f9-1cd74c30553f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70d171a0-2a4d-48d5-895b-ad5c7ba1ae18", "sighting_of_ref": "indicator--1a01dc6c-6b2f-45da-8d8e-b75377265f37", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57d638d2-e640-4324-a18d-618615929d0b", "sighting_of_ref": "indicator--55838c0a-a471-42e8-b083-d933038b9f1f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f2693fc-8570-4ba8-9925-c2a8a4c1c676", "sighting_of_ref": "indicator--cb08fe09-4bf6-40db-a72f-e6344752fe39", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--025bc6dc-dc21-422f-a4ac-30534bb12f14", "sighting_of_ref": "indicator--30a45070-c9ef-40cb-96b1-906bb142ed41", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb27fb76-b2b9-4fb5-979d-c363b95528bc", "sighting_of_ref": "indicator--5e0a89a3-118a-4b77-aab1-a90bf5e2a829", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7963908-b72c-4fb7-979e-1c282648805e", "sighting_of_ref": "indicator--f142241b-da30-4467-b7ea-54e6b23fd8fe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a04af15c-0fd4-4bb4-b1ae-7c7716d17d1b", "sighting_of_ref": "indicator--626ed23f-1c0b-431a-8f0b-b270110d5904", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--043ce28e-1d76-4e21-a6b6-d9d968e6fac3", "sighting_of_ref": "indicator--a6025ba8-3050-4343-86a7-bc9b8735b167", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e23022b2-ebb1-454e-b6c2-cbd28d07cba0", "sighting_of_ref": "indicator--8cdbc129-3554-43bb-a7ae-9c973a2b0fee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d827fcb-5adf-4a36-974b-95b0a81daa1f", "sighting_of_ref": "indicator--1bc55c8a-7633-41be-a564-a8affcab354c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a618f58a-e362-429a-8505-a74fd6dcf6dd", "sighting_of_ref": "indicator--427519af-b3b0-4697-a034-7ee3536a9563", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7523ff17-b704-4b1f-8995-81c04e473515", "sighting_of_ref": "indicator--5d101c22-1bb3-45e8-ad2e-b41cb0bda5de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeaba8f0-5cdb-4d12-a558-ab8d7a72b445", "sighting_of_ref": "indicator--d25a812d-5a8c-455b-a338-b8ccd3649295", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ace57b3c-652f-49d0-b326-ab0fd120e2ca", "sighting_of_ref": "indicator--22e4d6be-6666-4fa7-94e2-e70346006b47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8fb755a-c1e2-4e63-8b9b-70c99fcb6766", "sighting_of_ref": "indicator--834a3f9b-cbf3-48e9-a186-b76381cc04c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce88041f-1a31-4d93-b3d6-ad4de07f8328", "sighting_of_ref": "indicator--0f314531-08a6-48d8-8cc8-85dfd152772c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af811d39-9df7-4f9a-ae70-9dff485e6b4d", "sighting_of_ref": "indicator--564ad651-1dfb-4fb5-a44a-9aa801065ab0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4efea3c7-c3cc-4304-a6e1-65b7ede9ee5e", "sighting_of_ref": "indicator--58751697-dcbc-4990-832d-8064b9ce28cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bff2458-6413-4131-9217-5a3d0ad93f68", "sighting_of_ref": "indicator--25b4b8e1-c2f0-478a-be82-b2e9de702e16", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4cc3fd7-bfae-464b-b685-1cc95ba5d5a0", "sighting_of_ref": "indicator--8dfaed1b-f1f0-4bae-aaa8-4f9f03dc25eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--753c0096-7427-4a3a-a18c-977b69e60aaa", "sighting_of_ref": "indicator--d67d2c63-fd4c-4c13-9e45-b45478cb8647", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f79ccaaf-e4aa-4a98-b0f9-1df6eae4b5db", "sighting_of_ref": "indicator--20411aaa-a624-4c20-ba1e-3c84d9384f82", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f79dc1ec-eeee-4885-9f3b-fb03fff06c9a", "sighting_of_ref": "indicator--16b0fe92-237f-4ba7-8e03-0300f2e153cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e406403d-2fee-452d-88ff-340a43ef7bf5", "sighting_of_ref": "indicator--bddcf2cd-f53d-44fe-9475-13a91572597a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cc925f6-ee6c-44db-9af0-b0d4c48c8d1b", "sighting_of_ref": "indicator--b251ed12-2e68-44cb-9cd1-d6757744ff79", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab90dfe6-cfa0-4bb5-af91-77fde6d8b60b", "sighting_of_ref": "indicator--fc0a826b-6e48-4828-b01c-ca463658f8a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f701dc7-1ceb-426b-94ff-bf87f173486e", "sighting_of_ref": "indicator--489114e3-1967-4716-9aa1-ea50561b9d33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ca9b7c1-ba5c-4f95-97d9-116d80aa5969", "sighting_of_ref": "indicator--d216770a-a4b5-4a52-a8fb-723cc8623b56", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c23809e-900a-4c28-ac10-b66416a58608", "sighting_of_ref": "indicator--ccb4dbe4-9e69-4095-99ee-82011a0f3a0e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2b79d5d-5b10-4be3-b06e-139e0c8913ea", "sighting_of_ref": "indicator--8afbb396-6680-4e10-8b2d-016a594d9317", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--872d03c3-8275-42a9-9c0d-d9b4782f1edd", "sighting_of_ref": "indicator--1d2c8eb0-556e-4dcf-b037-063d2324e853", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef78e63-9504-45bf-aacb-f8a121edeeb9", "sighting_of_ref": "indicator--b74754f4-dcdb-4934-a3c0-615847e33003", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9224da3e-9a37-4a13-aec8-ecaefe52e45c", "sighting_of_ref": "indicator--f880835b-c025-4d69-8e19-4e03dcf8e62a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be401837-1974-4fad-8279-f55ef7fea77b", "sighting_of_ref": "indicator--032b4e7f-6607-408b-bc71-ea386a720841", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a01a7f4a-747f-4bcb-b26f-b203ba977304", "sighting_of_ref": "indicator--2e78c447-ac27-4454-a54d-1ce01b5e8f76", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ec8345f-0c4d-4064-b9a9-16df2a5c4112", "sighting_of_ref": "indicator--10378ba2-8acf-4955-9f29-3b3044c46df6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab39a79f-13e4-4795-abec-4fd1bf3fa233", "sighting_of_ref": "indicator--e9d669f3-9254-4daf-9343-8659ad6d12a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7809e619-5d36-4913-a718-c210020b5f3a", "sighting_of_ref": "indicator--b7ed7fdf-1d7c-4cac-bb07-290d4433732d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13c018be-f253-4be1-8c04-60ce5e524ccf", "sighting_of_ref": "indicator--c78a8713-5233-449d-ad7a-a2896fe5bf32", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00698829-71bb-4af2-88b9-791f5941995e", "sighting_of_ref": "indicator--b27616a3-af0f-4370-a8c5-1e29e1986105", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f57ceda-ad17-4d3a-bed1-5870fdb780a5", "sighting_of_ref": "indicator--87552243-d089-4bd2-ad67-a3ab50af7cda", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--986c64c2-f007-417b-bbe4-48fdcfacb7d1", "sighting_of_ref": "indicator--e1ee15c4-cde7-40e6-9627-5782b1c91972", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95f36005-d458-4dd5-92c7-8b32b2593826", "sighting_of_ref": "indicator--6b363405-3302-4f71-921a-a27b2cbbdb05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b2f0acc-9c11-4ec9-93e0-5ae7dc7f41f8", "sighting_of_ref": "indicator--0bbc2fc8-1607-4eb4-889d-6962e4ec6756", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebd1606f-e1c1-4d75-87c4-27284aa85615", "sighting_of_ref": "indicator--ee13ba41-2919-464b-a5a4-11aea97ca7d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63a2c9c6-cb37-41df-bb45-9a99422cfdf5", "sighting_of_ref": "indicator--f3c14e8b-c100-4a78-ae07-ee37b67b4331", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95329937-76e4-4777-8a69-438d3af98352", "sighting_of_ref": "indicator--5616794f-0559-474e-ad46-9f5e63e60295", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99e4a173-8732-42f9-b0f9-c158c2268649", "sighting_of_ref": "indicator--77f20a77-b5a3-4df7-af3b-3170d4224942", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89147c06-926f-45b5-a486-35282ba447f5", "sighting_of_ref": "indicator--03026854-6490-427d-8285-e9add5cec9dd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d097d055-dd1f-4764-9302-ef684feb5fc4", "sighting_of_ref": "indicator--f94c4cdb-fbac-45fe-80b7-76d00eebe0f7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f10b7ebb-793a-4fad-81db-bff49a1982e8", "sighting_of_ref": "indicator--bc7f710f-9ec0-49d5-98a7-d2ced339ec08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87dda626-e96e-4da5-b62c-f3ec76a2a4dc", "sighting_of_ref": "indicator--dfa0f7d5-8380-4a1a-a9db-611fdc60788a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62292d6c-040f-45ee-8a31-4f2585a46cc9", "sighting_of_ref": "indicator--2d1f3393-c946-4fc6-a8ba-d4af0d244f58", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62d1b320-41c2-44dd-a506-c09979a85bc7", "sighting_of_ref": "indicator--cbbb1c80-12b2-455e-9f2f-a7fa34e6110d", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ba3c14-9144-4439-a949-a4644946096e", "sighting_of_ref": "indicator--342749c8-9382-43c2-9468-56b8684fb8bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7da1b5d2-d41f-40c6-a7ae-38e9439acaf1", "sighting_of_ref": "indicator--66b2fd9b-80d3-4d60-9f12-1d7a120bebf0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03e9dc4f-6323-4d3a-bab0-8fffc162af8b", "sighting_of_ref": "indicator--97007689-5c40-447d-9530-75f45f341431", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8f3496e-99d2-4b52-8e4a-aa430a8c1b9d", "sighting_of_ref": "indicator--d6d20c07-480f-4d6a-ae50-a52c4d4d3a75", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47c732cc-479a-4764-8a52-894e92003945", "sighting_of_ref": "indicator--c1638c56-9488-41b4-83f7-9c370c1aeb34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c7bc32-5b69-4894-b35d-19f51256b581", "sighting_of_ref": "indicator--221d5259-4b0d-413e-a0a9-35f7e19d85be", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9221056-ea92-40a5-9ac4-ef96fa9f1a10", "sighting_of_ref": "indicator--c8c544ff-9011-4ba8-b010-838c3c26396c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b64d223-5994-4922-af50-0f64dbdf8303", "sighting_of_ref": "indicator--742b7e8d-8e21-440f-b22c-59571124ca06", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3339fdf5-2e0b-4cc7-9760-630c76632ea8", "sighting_of_ref": "indicator--d6b370ee-0406-4450-b3f2-40fe1b06ef05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfbaca06-4fdc-4a97-9afd-5381afe114f8", "sighting_of_ref": "indicator--74408aea-37cc-4f0f-986f-257779a10ea4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a6d8c2b-c2a8-487b-af38-9395a81c2e4d", "sighting_of_ref": "indicator--d2cae3ea-81ae-4836-a0b2-9b1358f7ccf5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08e88401-d806-4f7c-b4b2-7031003c2132", "sighting_of_ref": "indicator--bacd56a9-df34-46f9-a0c0-5dda24cf74ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d62d84d7-0691-4bce-bbdf-b300653ead01", "sighting_of_ref": "indicator--5a690a50-86cb-4e1c-93f0-2f35bb291d0f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09a5080a-8231-46ff-9f05-191bb0556139", "sighting_of_ref": "indicator--827df13f-6f98-4199-af41-c15c7e03d196", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ff60a1c-cfab-40f0-b829-8595fb3177a2", "sighting_of_ref": "indicator--17b11b69-2062-4ebd-a361-f3ec05550fc2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0481837-a5ad-4ea0-a836-2ccf2aa9d242", "sighting_of_ref": "indicator--c870ef0b-542d-4dc1-b015-ca927c3a379c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf4b9d6e-04a7-44b0-86c5-f576f126fd35", "sighting_of_ref": "indicator--8b0a22da-eefb-413c-b9ac-23353a4ec15d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3adaa65d-7855-437b-a1af-d90feb378b00", "sighting_of_ref": "indicator--78a6635f-2084-438a-b909-6495b47433d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dac4650f-029a-465a-8b63-c7b35da5d76c", "sighting_of_ref": "indicator--45991d55-2069-498b-bfe8-6d321cef7691", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21ef4a0b-adc0-408a-9a4c-d8d723e9c032", "sighting_of_ref": "indicator--381c9cf4-6ad2-404e-87e3-f728d24832c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e09f35ac-9ce4-4663-888c-f269ab997c54", "sighting_of_ref": "indicator--9b8f5407-e31f-4415-830e-f61a9158ab55", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b489c9a3-f472-4ccd-a713-29973060e958", "sighting_of_ref": "indicator--c6ab6c79-23a8-4af1-a49d-1d222524f56b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66cfcc8b-f417-4f5b-ba5c-e982c6500b02", "sighting_of_ref": "indicator--3b99130b-c664-42fa-bda3-04a4da960e48", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--887607b7-1e35-4bdc-8ae3-0a2a5a1d716f", "sighting_of_ref": "indicator--db973404-171e-473f-9542-7ff7040de28b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8ff72ac-5cbc-4c08-b85b-70ea133e49e9", "sighting_of_ref": "indicator--ee35f8f1-97ce-44ab-8c46-dd59a11987ce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc33c4bc-29f4-4870-8585-5b5737e94910", "sighting_of_ref": "indicator--33b3449a-667a-4598-a6f3-d8ac6661f271", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dec80e3-1484-4db5-b2b5-18747f1caa0b", "sighting_of_ref": "indicator--07929e2e-4ad2-46f0-91de-9ac6ae41be66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b04e53a-b0c9-490c-b50a-dd11ba726a51", "sighting_of_ref": "indicator--39dfbfb6-b816-40e2-a72d-637ac8a06ca6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e528dd2e-1b1e-475a-8a72-c3349846dd8a", "sighting_of_ref": "indicator--b1cbd55a-ad5a-4b15-93a7-1c9a0ba74422", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c85b6a4e-8d98-478e-bc30-20380862ab35", "sighting_of_ref": "indicator--3b7e87d9-9c97-4560-bc06-78f5eb9af203", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b4d5681-642d-471d-8e86-b50ca076b23f", "sighting_of_ref": "indicator--f0de1d33-2052-47e1-8443-e613cb191fc1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3772824-c516-4d9b-8b63-da6cba89e9c8", "sighting_of_ref": "indicator--51991e77-b74f-4c86-9e15-42c8cea14b1d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7cc9365-cfdd-4e16-96f6-3e5b78246835", "sighting_of_ref": "indicator--795ad1f4-a18e-4add-bed5-09b67c440a8c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37d62927-986a-4746-90d5-0b6a434616b3", "sighting_of_ref": "indicator--06a548df-b895-4801-8a9d-4da57346fcc6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f213788-9549-4b3a-bae4-edb56844b52a", "sighting_of_ref": "indicator--f358dcf1-c3b8-4c5c-b7fc-fc0d09e00831", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d010cec-6261-4c44-a228-2295a870587a", "sighting_of_ref": "indicator--b220d4d4-02dd-4f25-8986-a676ad591021", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7cd4aeb-301d-4eb0-a697-59f959b57f4b", "sighting_of_ref": "indicator--e857a9d2-8ec5-4686-b808-2728067b8067", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33563223-5e3b-486e-8d65-b6d74f94d3bc", "sighting_of_ref": "indicator--88d52929-1627-45f9-9b05-1e4ccdca340d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca70b8c7-b3a7-4a99-8ef3-7c557b6ee102", "sighting_of_ref": "indicator--9c197d81-048e-4899-a877-2fa7a517f2bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--704bc4a8-7a2b-47ed-93e5-01198a0633ed", "sighting_of_ref": "indicator--ce460f4f-f621-4dea-ad5a-a3d653ef2d74", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00e9c7b6-0ac7-44e2-b8ae-2da1f85462ef", "sighting_of_ref": "indicator--55b8a452-1017-4de9-a7b6-148ded1e715d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f450dde5-b0de-4824-b5ad-a451eaaa0b16", "sighting_of_ref": "indicator--7202e57a-8765-4d13-ad0a-30cfedc1dcbf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16a62107-e952-4206-95b7-d26709203884", "sighting_of_ref": "indicator--e0ca4a4b-0954-47b9-a700-79b27fef4c9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bdf226c-c908-4a72-b2cc-c2a3e285ea5e", "sighting_of_ref": "indicator--1f0e5358-4c73-4d6c-a3bb-25573124cec8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed825235-c116-453a-a588-ac9c525f177b", "sighting_of_ref": "indicator--db88413c-ac26-4981-ac82-340a24aeae7c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--181f5dce-02b4-4f86-8230-32e1e8e3a735", "sighting_of_ref": "indicator--70425bb5-1877-4231-b342-0ed8d385987f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--809c2a7c-ea91-4eb9-a258-a088b2cf889d", "sighting_of_ref": "indicator--11f4ac6a-ac04-4af4-b2eb-7cb36ba8a4e2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d94c8c9d-6ddb-4474-816b-cd2c0b84fbfa", "sighting_of_ref": "indicator--704d3c8d-ec78-4aed-8ad2-6af4aaabc072", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de6c64af-a864-4b23-b443-1c27bc7faec3", "sighting_of_ref": "indicator--b3dad900-4063-4395-9c56-bd631499b007", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d11a005-1430-4b66-8025-fa27af454772", "sighting_of_ref": "indicator--e16520b0-66ba-4413-a373-af31074d7a05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f0a8985-9988-42b4-a019-5558b4b044d7", "sighting_of_ref": "indicator--56e054e2-ad24-4f0b-b0e2-5c5f1e25414e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--935f48af-b4e1-4c9e-acd8-88b32f1eb0d6", "sighting_of_ref": "indicator--02be40c7-56c0-46f7-a8e2-14c57ce271c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ae300b6-0996-412b-b353-4ac89ca6307c", "sighting_of_ref": "indicator--281d7816-b6b7-4186-ba53-2d5bcc74a4c1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a898e9b1-6cb6-487d-afcf-96bc42203d54", "sighting_of_ref": "indicator--d012e707-81db-4c7c-8d80-29f74b73912d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be6dc46b-9ce3-4d45-94ea-00745922e2b1", "sighting_of_ref": "indicator--438257db-8991-4568-b338-27978b25e1e2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--813d835f-36c8-43f0-a229-19c881046e63", "sighting_of_ref": "indicator--e5969246-8b1e-460d-95e8-8836009e9403", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aa92ed4-8c4f-4e43-a0a3-80f62ca96f3c", "sighting_of_ref": "indicator--20b5c498-547b-4b32-8e20-aa6a2b9a661f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adf82f26-9984-4b37-b58a-57a5038e2024", "sighting_of_ref": "indicator--c0305b60-e2df-4626-9e06-b27f370863cf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f1579b7-1c4b-4c6e-aa4f-36d3f8e26f4f", "sighting_of_ref": "indicator--28b1b429-2ad6-4bdc-9631-618a37f79721", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6019a65d-e28f-452f-954a-8e04a96f159a", "sighting_of_ref": "indicator--4051175a-a980-491a-9130-afdf4bdc1bd8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68ba6ac8-783f-44f9-93ca-a1f6f131dff0", "sighting_of_ref": "indicator--5fe042c2-0944-4efd-92a0-2f9ca48b8d14", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d428884-89ce-47d7-9cbb-e61c966e4398", "sighting_of_ref": "indicator--85b9a972-6e04-4272-a1a2-5ea67f661d47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e316b39-2150-4cee-93ea-8c738ec88d51", "sighting_of_ref": "indicator--4d9832c6-5e40-4eef-baa9-3024c64445b0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3cd7c70-935b-434a-a233-60a8824a4587", "sighting_of_ref": "indicator--70f884d8-7199-4e90-8e43-673e8d4cb067", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17fafe77-51c1-4f00-9659-49d5583d2e36", "sighting_of_ref": "indicator--e2e5a79a-9318-4f50-a936-5c1cd6dd3d22", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70f144db-bcd3-4923-9081-831daffa0a8d", "sighting_of_ref": "indicator--540c5c61-07cc-4529-bf19-bf9e30fc5615", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15dc0d70-3d27-48c5-995c-30d01c776d72", "sighting_of_ref": "indicator--69e6d25e-babe-4c7d-83b1-7364bbee5f7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5326f87b-b1e3-4b4f-aac2-eb6884f31e09", "sighting_of_ref": "indicator--1562b0c8-6c8a-4ba5-9ac7-6f74ed1429e1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fd1e236-e06e-46dd-80c4-d2899408ea91", "sighting_of_ref": "indicator--c3ac3cdd-9c74-4579-9288-76811af04d52", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ccd59e1-1a19-4a32-88d6-13c33998798f", "sighting_of_ref": "indicator--7403430c-7bb6-43a1-a14f-28df1e8fb305", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3caafaf4-0971-449b-8884-511dfa60ab23", "sighting_of_ref": "indicator--cfa7073d-fae0-44a5-a639-aefecc7577dd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2028109c-a495-4555-8f09-ef24229f0f5c", "sighting_of_ref": "indicator--5ab12922-8d27-4cd7-9d23-8ea6a63eaaaa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3f0b5d6-f6f6-4dff-a698-406ebe3aeae9", "sighting_of_ref": "indicator--28139a38-2062-4666-8f89-835f161b041a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef57d011-bdbe-4fed-a20f-2c27e42e3c4b", "sighting_of_ref": "indicator--69eea157-985b-46e1-8e66-e285043886d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49cd4b63-3e5f-4646-84de-efffd51a2eba", "sighting_of_ref": "indicator--05473798-f93a-48b6-989a-f671fd089555", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85dbb0ef-cf83-44a7-a991-6bb3c48bb803", "sighting_of_ref": "indicator--892ea142-9c22-4d24-aa21-38e3021af154", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41b61f8b-8e12-4e34-aae5-29bd75c560e1", "sighting_of_ref": "indicator--383b79e2-154a-48be-a738-b7ef5befa047", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef3ad44-55ba-46a6-9a27-0227de3356ab", "sighting_of_ref": "indicator--402c46d1-303c-4341-b7d9-cf63d9ac9f95", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a6a146a-70de-4901-905e-8eb10ac760d2", "sighting_of_ref": "indicator--80acc271-41fd-43dc-9cda-a34a88196a55", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--595bdc84-f112-448d-b3f4-bd7cb701e6f8", "sighting_of_ref": "indicator--a90953a2-4172-49d9-9757-255ad56ad1b4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43bd9216-fdc9-4d5a-80a1-c4df41430d0a", "sighting_of_ref": "indicator--ba069af8-a57c-429e-b62f-7ec8f2c9ecc9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4469d209-4a2a-4616-8be8-68c7a6c8d5f9", "sighting_of_ref": "indicator--956bc7ad-a1c4-4596-8194-d0acf9097faa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa4db277-e119-4789-9f99-9c155f0d98e8", "sighting_of_ref": "indicator--1856a8d6-b9af-48e0-9c63-fd7c98c89c9a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db4181aa-4f69-4f7c-b283-9772aa34a431", "sighting_of_ref": "indicator--3052abb2-e2e8-4126-81f1-b2e1db6ff94f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6de02e4c-baaa-4033-8cc2-a0bd22aeb479", "sighting_of_ref": "indicator--894fc737-43f5-4e58-b281-088fa610a622", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ba47a66-73b0-4fe9-a975-c8cce62755da", "sighting_of_ref": "indicator--b1a31da4-216d-460b-a97a-08e6d3b4f77a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e365b15-dc15-4ae9-9dd4-9e14b234bc48", "sighting_of_ref": "indicator--e3b9048f-bf8e-4daa-8c83-e1b9b4ecd0bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2816d3dc-1cd7-4c94-aa55-926a94f989a0", "sighting_of_ref": "indicator--b146afc9-a0ef-4728-b48b-8bdd0c88ec65", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbc7ef42-d75c-4f57-bdbb-93ce736592ef", "sighting_of_ref": "indicator--d17b27af-0b72-4264-b0be-995f230ab25d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7e0f373-1378-4d7c-9e3d-bc312988a696", "sighting_of_ref": "indicator--02e3591d-99a0-446e-bd22-f9f4f7635371", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9910f734-4e33-448d-80c4-aac61100197f", "sighting_of_ref": "indicator--efaef0cc-f2c6-475d-84d7-00e6048ee631", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--757ce7e0-8607-4f9c-894e-a1800d763056", "sighting_of_ref": "indicator--74c0f5d4-b5b8-4652-9f8f-c8ab072a9143", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6137c18-d364-4417-b238-bc2854dd7a2f", "sighting_of_ref": "indicator--e3aa02f8-43c0-45ee-a8f9-f7794b2fd7f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3641e411-3664-4ae2-a56e-f3e063b38191", "sighting_of_ref": "indicator--3daba74a-7c1c-4110-bd78-62f778b1a364", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ba3d8b9-609a-48d0-aff4-94a37b516d4f", "sighting_of_ref": "indicator--1b7be389-539a-40bd-8ba1-bda76562292a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--200dfe94-e95c-48cd-a6a4-b9cf71c985f2", "sighting_of_ref": "indicator--f7e34b56-f55c-419d-8437-6aad93b735fe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5495c35f-3cb7-4ec1-a684-aabfd3eceba5", "sighting_of_ref": "indicator--9258288f-6e44-4a95-a9b7-170848d868c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--974abe7e-936b-46c2-9cbc-d485e150349e", "sighting_of_ref": "indicator--93bf81d3-cc10-42c5-8ca2-38acfcac75b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f7e9463-74a1-46e7-a6fa-6dad4834e523", "sighting_of_ref": "indicator--94f4cc34-6160-41e9-9025-c0c961e5e834", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--947571d5-dbfc-4f8c-b81a-4883a66a879d", "sighting_of_ref": "indicator--1f0a87a8-e369-42f6-b6ab-dc39be55c839", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f01fda46-8ff7-486b-8fc7-455be9878f67", "sighting_of_ref": "indicator--aa363664-9b86-4df3-ac94-ca352543b6bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34019a1d-5962-4eaf-8429-0d45fe40ae93", "sighting_of_ref": "indicator--5d05fabc-b4eb-4942-bbd8-f13379fd8912", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55e9a8e4-69fc-4e1f-b1e4-05ad9157c938", "sighting_of_ref": "indicator--00345625-69ed-4cf8-b206-920517b1b405", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--124c2bd9-464d-44b3-b95c-3bd46b33cd1c", "sighting_of_ref": "indicator--98a830d2-a807-4abf-9055-888c29c92486", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ecb7475-46f4-49ed-9a7b-c99ce6e5dfb1", "sighting_of_ref": "indicator--0fa1fe63-2a80-4cbb-aed0-52a24190f973", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d0b581e-0430-478a-9df5-a7cfaa074460", "sighting_of_ref": "indicator--f568f8d8-ab2f-4270-a546-60f3695c3d57", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aa49f2d-183e-485e-9c00-3513d3c4ffe7", "sighting_of_ref": "indicator--551269ef-b416-46f0-b863-92a31e3f6f19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a442ef7-a2ee-41ea-8ba5-44d76afc02a1", "sighting_of_ref": "indicator--f24e107b-f641-4b54-8e45-d8ed0e821d54", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e497eab0-ca00-4204-bf18-67721917ebad", "sighting_of_ref": "indicator--3b9c0dbc-17dc-48ce-9ecf-a93737e2b010", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac63391c-8a77-4cb9-9b42-253cd15eb495", "sighting_of_ref": "indicator--762f1fc6-0738-4436-95f4-f4219660db13", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--664a37f8-264f-433d-a25a-98d54b29f35e", "sighting_of_ref": "indicator--6b38380b-e683-4acc-ae5c-bb85dd29ed77", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--301cb86c-18b3-4caf-af0e-ff669e00e67a", "sighting_of_ref": "indicator--183e3323-3929-4d6a-9b9d-aa634a853ce6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b2b8be-058d-4cf4-8c3c-7e2fe08106a0", "sighting_of_ref": "indicator--28e34560-40b4-4e5a-a78a-bf024aa77271", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c276c3d-dd95-48ad-a21f-c0c1a124fd2a", "sighting_of_ref": "indicator--a5ffaccf-5b61-4979-8261-d1ddfbb081a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72c108a9-f5e2-4a59-8c50-91ec1e85090f", "sighting_of_ref": "indicator--619a47fb-7b8c-413a-8dd9-f445d090be61", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd263398-2165-4e11-b957-16ca10efe14b", "sighting_of_ref": "indicator--d8a99570-ebd6-4d45-840e-7ae1f78e47f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d2388b-ee9d-4049-8ea8-4d59b2fb0d21", "sighting_of_ref": "indicator--1137e604-1327-4498-b72e-d68b65bcf238", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f1bfac2-1f19-4c14-9315-772d49e21a0a", "sighting_of_ref": "indicator--1227ba86-e6db-4a53-8eaa-780b4cf0eff3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f12f490-4242-467a-b857-b2a90c458842", "sighting_of_ref": "indicator--e9f22462-1cd9-4cd0-95e2-b09fcc5173fe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45383e62-9703-455e-a5d3-7cc2bb917205", "sighting_of_ref": "indicator--0d66ac1d-aa48-4884-9022-060b6fb39edc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cb36765-5d0d-44b4-b3a6-3c94acc9bfd1", "sighting_of_ref": "indicator--34594492-fcd1-433a-9bf6-ef5df8dd7991", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a69f54c4-8a86-46cf-a062-53c4229c64a1", "sighting_of_ref": "indicator--3c0a2dfd-6cf9-4183-af19-9f92500bb45b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b37959-0cbf-436e-81cd-0ef8214fff43", "sighting_of_ref": "indicator--6e95459d-7559-4c7a-a987-172a119c193e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7901557-a2e6-4240-9278-5de402d31cfb", "sighting_of_ref": "indicator--9409cc25-4328-44fe-a0ed-d3057a6419e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2975814c-de7a-4276-9229-8cf14c3eda01", "sighting_of_ref": "indicator--4785beae-4db7-4c6e-88c6-46ac1d664121", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e1e580e-6ed8-4df9-a5e1-0817811ad02f", "sighting_of_ref": "indicator--4146b0e2-b43c-4930-af29-52856fcf9006", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dff6ce01-da8b-4f36-929b-3ae06d687cf0", "sighting_of_ref": "indicator--bcb1209f-fcee-40d6-b857-371cfcdfd7de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a312d4b-ffc3-499e-9be5-37aa454c2a0b", "sighting_of_ref": "indicator--2111258d-5d33-4005-beaf-c0c409439c74", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f5ab3ab-27c1-4096-a839-0b338e01bb2c", "sighting_of_ref": "indicator--289405b0-e47f-4420-a97a-e93059ac9b4e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45326e06-9700-4e4d-8e2c-b94f49495210", "sighting_of_ref": "indicator--0f0c3fcd-d077-4821-9756-964f166e99ce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f02bd58e-b3fa-4741-8f4d-3dd9d2437a71", "sighting_of_ref": "indicator--c9083f9d-d4cc-4f4a-834c-9bcc610235d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffe6984e-706b-4413-8934-f1b41b27d0c4", "sighting_of_ref": "indicator--6c888b3c-9c5d-4d3b-a4a4-0aaa844169f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291d57a1-861c-4401-8522-fd3ce6e80188", "sighting_of_ref": "indicator--a8bec432-87c6-4de6-aa29-206362205a1a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94969f34-a868-4b85-a313-db15a6ee79f2", "sighting_of_ref": "indicator--2e1a4c90-f2d4-4809-b838-4aa95c23376c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--750c888b-c696-470a-8af6-2e1fc0500213", "sighting_of_ref": "indicator--f6d4d764-298e-4da4-8a8f-f6c4be989daa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--819101b1-91ea-4cef-81a4-30f7abdfb161", "sighting_of_ref": "indicator--71977040-84f9-4dff-9f75-6a8151f14d24", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eae2593d-b729-4fb5-9c86-49cb9731aaac", "sighting_of_ref": "indicator--4802a66b-df47-4202-9224-0935c5f4799f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4a02725-0ad0-4205-bfcc-33bcf76eb4b2", "sighting_of_ref": "indicator--a29ff5a3-3dde-4ed4-b39e-8dea559bcdb1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b5c4937-925c-4e93-9392-8049ce3b3a4a", "sighting_of_ref": "indicator--c96c16ac-81cd-4e9a-9a08-c5048665f54e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fb64e60-1cb3-48f5-803b-1410fb4bd20b", "sighting_of_ref": "indicator--81d02b8c-87d1-462d-af64-869e202d4f7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f369853f-5974-4545-8e41-ebf5e1dd389f", "sighting_of_ref": "indicator--5a2d3b6e-80c4-4665-92b2-b627e395bd4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5b30a6b-080f-4c05-812f-8e7af733d612", "sighting_of_ref": "indicator--95b7c3b2-6d0b-411b-8c70-923f0b0429ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec35ce19-b9f5-4c44-ac0e-854e732a038f", "sighting_of_ref": "indicator--6f34a6ed-ff26-4586-ba3f-65296b8bfe6b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f466fbc-84e7-4c7f-b922-93ce2e45cf76", "sighting_of_ref": "indicator--48176c24-ce90-4603-9207-8f214eb6b913", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--994f576f-514a-432e-b5d1-8e1458d9945e", "sighting_of_ref": "indicator--d17dab10-7f21-41c4-8a0a-b49666ff9dd8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ea56728-abdb-42aa-a6dc-ced3e3905735", "sighting_of_ref": "indicator--1d2c0a3e-f0cc-4323-ba2b-bd9b1602076e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eae8094-17b4-423b-a625-92450d6d6e51", "sighting_of_ref": "indicator--bcd9b46d-7741-475a-beb9-2cfd12ba2e7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fba92cd-81ac-4505-82c6-a5b5a3a177b5", "sighting_of_ref": "indicator--ab94728e-068d-401d-8ddf-98077e50d7e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27ea994d-083c-4a62-92a9-111cbb435f33", "sighting_of_ref": "indicator--adf86590-ee39-4620-80c6-b10da85881ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6df95c7-a8d8-46ab-906f-ec406c10c2b6", "sighting_of_ref": "indicator--e959885a-c2a4-43e6-9f05-c44baede4ba2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f86779e0-0159-4688-99b1-48f28514dd6b", "sighting_of_ref": "indicator--ab90a8c1-fe42-4cde-9ba9-ca27ca53cb59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a821e28-24d6-44fa-8429-38f5d506ed1a", "sighting_of_ref": "indicator--925c1dac-9549-4285-af7d-1ca4d960b4e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5888ef5-2ea8-4d97-8d42-09e2d185216e", "sighting_of_ref": "indicator--a1b6b22b-911d-4e51-bb0b-77601ccba919", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c9af1a6-80b4-4421-b3c2-2627708e04c0", "sighting_of_ref": "indicator--9c4f7298-28b2-49bc-a4f2-db314560dd83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d11d57a3-0c56-43c0-9876-c1d94fb9512b", "sighting_of_ref": "indicator--31fe6212-9449-4c5d-a98c-45e54a4000e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96bbb84e-0db6-412a-916a-5ebec2d914be", "sighting_of_ref": "indicator--d199306f-dd26-4eaf-ad5d-fc59d480acbe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--079fa96a-f893-4b57-929e-a5f44bdffef3", "sighting_of_ref": "indicator--bd67bf77-2a83-466a-8679-f0e1a6712121", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3569a88-d911-41fe-ad0d-4ec8f07121b8", "sighting_of_ref": "indicator--b580f1d1-eb8c-4c0a-bb80-9a32c0d809f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f94cc0b9-fc3a-400b-841f-063c3200e8b0", "sighting_of_ref": "indicator--cd129672-011a-4b74-93aa-120beb2c8d68", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d43ff4-65af-4215-98aa-bfb91abf1539", "sighting_of_ref": "indicator--692fc93d-43ab-44ce-9a0e-1ccba10eb827", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9680b38-f91e-4ebe-8b4c-02962f1241d0", "sighting_of_ref": "indicator--52326535-cf72-4b75-810e-8db09ba51abd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90df0697-a176-4a88-a50f-197f2407a52a", "sighting_of_ref": "indicator--f08d76d0-5364-4709-b1b3-0b5cdeb87da4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5e6da33-1b56-44e5-abc4-6ccc893ddbcf", "sighting_of_ref": "indicator--45070300-c0a4-4500-9dc7-4ef7b6899382", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdfe512e-183b-46b0-89ff-28bf70e20afd", "sighting_of_ref": "indicator--8da30bf0-e593-4e60-be6e-6b2a3dcd3583", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27640d2b-4db3-4b7f-94b2-b6c7c4d596ba", "sighting_of_ref": "indicator--e69a39dd-7788-4483-b17f-0b70174c8832", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99496185-5962-4bda-a4da-38eb0c3b1ce1", "sighting_of_ref": "indicator--73140334-8153-451c-a0f8-8a8c9b9bab58", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae77d7c5-2ca9-49a6-a9f2-244edcf1f6f1", "sighting_of_ref": "indicator--1e0eb72a-4078-4dbb-9a05-7ec46b1e75c8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3a11932-b2ab-4237-a51c-33b0a9ad4ebc", "sighting_of_ref": "indicator--391ca9c8-9df4-4581-bf58-0418dbafc092", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec376102-a829-4e9f-a38c-5c76ba27643e", "sighting_of_ref": "indicator--576589d7-59ba-4bb7-af62-0fedea10eead", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59634048-4041-4817-9ca1-378da0920a73", "sighting_of_ref": "indicator--2b26fd3f-3447-465e-bff7-1aa101944718", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--237e34c0-b77d-4737-8b9c-140f891d0cee", "sighting_of_ref": "indicator--371ccf5f-16a9-443a-bfcb-c1adf6d2b8b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7344f47-7ea8-41fc-837e-322465c3920c", "sighting_of_ref": "indicator--552937b5-b334-486b-842a-cf03393ade1f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f945591e-ca0c-4200-b20b-b837488e470f", "sighting_of_ref": "indicator--c582c3a4-7428-40eb-a854-c31502301382", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f3ab05b-3ec1-40d4-8c77-a316df5f4d60", "sighting_of_ref": "indicator--60c19246-094d-4186-976c-e92d9cb672ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e05bb79-527a-417f-823a-0059667bca73", "sighting_of_ref": "indicator--184285f6-2462-4a4c-a4e7-b4874febdecd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d48291-795c-4509-9406-f14771396829", "sighting_of_ref": "indicator--3be93231-209d-4a77-8cea-7d6ad683cb2d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab55c54b-233a-42f3-bd0a-0e9c6bdb856e", "sighting_of_ref": "indicator--81b9bfdb-8afa-4674-98fe-81c047b5f4d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7dafc31-64bd-42e2-b58b-ecd4593c1a67", "sighting_of_ref": "indicator--5b6b0a3e-ca56-45cc-bf44-1da4c487194c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caae1359-09dc-4133-9f7c-54a9b051b132", "sighting_of_ref": "indicator--49e4a77b-a2ee-48f5-aaac-843e9e91c7a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c76201de-c46e-495c-bb40-0060e8a44052", "sighting_of_ref": "indicator--069d68e0-5e97-4ae1-97a4-785ab6c07e9a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7edfc16d-a91a-42c2-b60b-ef5e9ec8bd5e", "sighting_of_ref": "indicator--d181f463-3937-4d5b-885e-f8efdd4995f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc0a19e6-2619-4495-a5f9-b9c1a8d13199", "sighting_of_ref": "indicator--265ea406-0be0-4188-bba5-f861c97d9376", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08100624-91a3-4d9e-8ce5-5ac7251028a8", "sighting_of_ref": "indicator--18e55ae6-b1c8-4cdb-9096-9d8360ddfcb1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a651e155-0ce0-4f99-957b-b69910abf725", "sighting_of_ref": "indicator--471d67f7-dc6d-4557-b1f9-497ea5e0ce2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f04d51ab-870b-4c4b-8f9a-d049ecc75b72", "sighting_of_ref": "indicator--8ed45cd7-e606-4c48-a281-e6589e88aff5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2f3054a-2d5b-4e94-9bc5-b2b8d54c9eb5", "sighting_of_ref": "indicator--437c31a5-a758-4bb1-a97b-8a9eeb805ceb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0678817-d0ff-4215-ad88-1514147877f4", "sighting_of_ref": "indicator--52f3a7ed-0321-4f3b-be2d-b486cc8a1043", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd464d2e-d652-4452-8afe-ebd6ea311da1", "sighting_of_ref": "indicator--cd15b92d-d702-4657-a3e1-bac84546af08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fdb1dbe-ad60-4fc1-9f8c-050b37b847bd", "sighting_of_ref": "indicator--838b9b46-8c6f-442a-9667-062717abd07b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1248608d-f203-4b09-8089-66d17d25e003", "sighting_of_ref": "indicator--cd6dccd0-68be-4995-bdbd-0e6959fc5db3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28c66f3d-41e7-4fb2-a638-ca7535182a93", "sighting_of_ref": "indicator--a102b487-2025-4600-8f32-f2bcf8615111", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5619cc0b-0484-4803-8470-0fb96f4a9c26", "sighting_of_ref": "indicator--c5a89c1e-4764-46ff-a612-81244d599308", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c251fa0-b6ff-4d21-9e60-cb81e939e501", "sighting_of_ref": "indicator--ef252171-ba52-4899-a99d-e21229a8dd5c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e493950-271b-491a-a585-876a56105685", "sighting_of_ref": "indicator--584e61b6-6666-4063-a85e-1528fb42c39d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b80a6520-05eb-4be9-8ce4-06cbacd77037", "sighting_of_ref": "indicator--00e8b925-1237-4248-a70e-ed6ba2a2c501", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b228f8c-c2a2-47fe-8c2e-64ff36c02d00", "sighting_of_ref": "indicator--d6215002-e99f-4f8a-8cae-2fb200d036e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c249c73-c3d5-4f26-9ad0-83d5be2b58fe", "sighting_of_ref": "indicator--f6f2560e-4ee0-49e5-903e-4230f31f09b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9e6603f-cc8f-4555-81cf-52d269012a1f", "sighting_of_ref": "indicator--ac4ba5d5-0ef2-4e7b-b6c7-d46b0bea6c53", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55ce8448-c8d2-4933-9f59-e0f8dd1b465f", "sighting_of_ref": "indicator--1c104080-15bd-47a7-b2bd-b3881dff01c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de5bd71-7b79-468b-bba8-e1f5d3c32639", "sighting_of_ref": "indicator--df0467cc-6c50-4260-8989-20a95d2bff80", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20bb23d9-ab71-4bb7-a7d7-661da9659f5c", "sighting_of_ref": "indicator--e4a0249c-c160-44ea-803d-059e669e89ee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81cee2f9-0702-4468-9fc9-ac90406fe915", "sighting_of_ref": "indicator--452121bf-2975-4e89-b91c-95c2f8fc1c97", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d915d50d-fab2-4d5b-b708-c691a5da7ed1", "sighting_of_ref": "indicator--32630211-5e02-45ac-b2a5-23cc087667a0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6902546e-4406-4af5-bca7-94a3f78e1407", "sighting_of_ref": "indicator--e394ca89-1327-4183-8b9a-8427984a8d82", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f3d4cbf-d312-48d8-a34a-490575fb4513", "sighting_of_ref": "indicator--d768cf2d-ee60-4e94-ba5d-76b39f0d53d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02ce4940-9d55-4a39-af14-9bd563068bee", "sighting_of_ref": "indicator--2ccccc99-4536-4d46-aa0f-6aee1fb16cdb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04c33cf3-609d-436c-ab2b-db3ebfb1e29d", "sighting_of_ref": "indicator--d402b044-aa83-4237-a43e-e22f8e2ef61a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--262cf7d3-66a1-4c33-b58d-ba991da99751", "sighting_of_ref": "indicator--c0539d89-1fcc-4178-a6eb-83824731d17e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--657bcc69-e2b4-4774-8164-e73cefe76b0e", "sighting_of_ref": "indicator--427aee45-9af2-493a-a23e-75e168827568", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abc66b75-6af8-4823-b152-6173d209c4ce", "sighting_of_ref": "indicator--497f7d02-0b90-419b-80ef-d0fe2da0529b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61315815-38ce-4f0e-bd8f-698fe00b0564", "sighting_of_ref": "indicator--38cd04b2-abfe-4459-b7ab-58844734d251", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ef45f04-688e-4a29-a63f-a4f4f67c4acb", "sighting_of_ref": "indicator--2254de6f-7e2d-465b-8e0f-eb70ce3114eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1fcfb08-d309-4839-959a-083b84213ed2", "sighting_of_ref": "indicator--b826e01c-bcdd-44ad-8f2c-51912c19d42f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9e75b70-7703-488f-a95c-5b6f386bfc15", "sighting_of_ref": "indicator--931d8462-fdf3-464a-85bb-c2a9a6fbecc7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--701eba3c-95dc-4de1-9f23-bdc34f61d13f", "sighting_of_ref": "indicator--f029f54d-db8c-4c9f-acdc-932487d44e54", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1843a5a-0294-485f-894d-9f2773fea3ef", "sighting_of_ref": "indicator--b160b060-1b42-4bd4-8269-7ce24598ab75", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b6cee88-cdf6-432b-bdc3-a39922b6b393", "sighting_of_ref": "indicator--7dc54017-08a4-4ce4-b690-a139afd5db8b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35d70365-7358-44bb-9d99-9fb8a3337dd3", "sighting_of_ref": "indicator--601b8bb0-345b-44ed-9c35-8d5395f3414b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5e019b5-12f0-4bad-8bd3-85d090cc7564", "sighting_of_ref": "indicator--34db0edc-b72b-4b10-b71e-de7b4ed0d739", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b17e2e5-45c4-4183-968b-e498b3100326", "sighting_of_ref": "indicator--111ac6c6-ec7c-40f4-a410-ce6215f1613d", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cd56315-aa47-4750-a5a3-23aa3d3d08da", "sighting_of_ref": "indicator--f8125fda-36b1-4d2e-bd23-9b6460d415a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29769942-3a21-456d-8196-61407faac167", "sighting_of_ref": "indicator--74ef818d-99a5-4d51-a3c1-a513ee7a01e8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--556e4a08-cfa6-43ce-ba81-1921d87600b1", "sighting_of_ref": "indicator--853c6783-a852-4f3c-84eb-8d59016e33ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--579007bd-66fb-4799-8bac-f64dc1c9757e", "sighting_of_ref": "indicator--87b92d85-ceb5-40cc-94db-3de9d5b65ffd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66654351-be09-4470-9cc2-ade4fff01312", "sighting_of_ref": "indicator--1df64c8b-6997-40be-9c6c-832c6c3ab7b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d0443e5-4d0a-4786-882c-0ccdacaeed8c", "sighting_of_ref": "indicator--da1219eb-8e14-453b-b3ae-f626f0533005", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1d27b8e-510c-4621-bc47-72ebeeb5f2a9", "sighting_of_ref": "indicator--d9a78c1a-4684-4065-98d1-cfb42e331e89", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af7456bb-7a0f-46f5-8b71-5470746b2c14", "sighting_of_ref": "indicator--28bba532-e9e0-4b90-b04c-07b97891660d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0364173-fa26-47ba-b33f-61044df429bf", "sighting_of_ref": "indicator--c6feed76-eab6-498d-ae1c-2c25cdae87d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc6887cf-248a-4231-9ebf-878aca949a88", "sighting_of_ref": "indicator--46976b1b-3e78-4a0d-b699-9264f0ecb03f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7a06b2f-f8c0-46af-b300-f7805cd2685a", "sighting_of_ref": "indicator--4dc6e5d9-8ef3-496d-b168-0c2a09caf7e9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3c7b105-37fc-4e8a-bfe0-4745259260e2", "sighting_of_ref": "indicator--4e17ee65-cdf5-4238-baa9-53f762bbba88", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2571ef8-7b44-4166-a041-f90010721000", "sighting_of_ref": "indicator--3642f0d7-49ec-434c-82e8-7e4eeaa04e4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67a4e085-acc4-4507-8ad0-919c33eafbf0", "sighting_of_ref": "indicator--3c59b07d-0140-4cfa-a3ab-5b4fedbae636", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b73f09c0-6e3c-4e12-94b1-108fea5da509", "sighting_of_ref": "indicator--082a242e-6372-43ad-8d95-a3b7d194cc91", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfa3b234-71d4-4ffc-baab-dd8b9035e221", "sighting_of_ref": "indicator--6ce721c0-1ada-4439-8a8b-7111b638762d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfd4d337-e968-47a5-bd00-abb054b09672", "sighting_of_ref": "indicator--442d121d-b6d9-48e6-98ba-69c4bf418a06", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c5f5177-b0f8-4d09-be6e-ee3577ae3133", "sighting_of_ref": "indicator--b7c9af8e-dca8-430b-a5c2-dc7e14bcc586", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b6c27a8-54e9-479c-bbc0-8b981ef55cfe", "sighting_of_ref": "indicator--92938efe-c892-4589-8a82-4c529227e340", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5efeb8d7-a677-4e2b-8662-da8c614d659a", "sighting_of_ref": "indicator--d5538726-c815-4af3-beea-8fcada5f0e34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f56d992-df81-4b20-9cb9-0003d35767dd", "sighting_of_ref": "indicator--3108d4db-3811-40ed-a7cb-89b8423d5ed1", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a44204b-e679-4735-b801-8ffdbfdcf45d", "sighting_of_ref": "indicator--569a328e-1cd8-4e85-a1dc-60282d461306", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--313e8b7c-c396-46b2-bd74-c1fa26fa1844", "sighting_of_ref": "indicator--0cd5f9ff-4e93-4023-88ff-c748cb436f37", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eee67ed-8daf-4512-beda-9982747bd0fe", "sighting_of_ref": "indicator--4212eb5a-fa9c-4aca-a2b3-16db28761385", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5272c65e-0a10-4841-969a-17a201cc3c7e", "sighting_of_ref": "indicator--91b20a9d-a927-46a7-bada-2113b5c815e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af058937-1006-4d84-91c2-bcff57884b02", "sighting_of_ref": "indicator--f3a8f042-4633-49e8-b37c-fb6517eb5cab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8051b32a-0e55-45ba-b2ef-e8e672facc85", "sighting_of_ref": "indicator--b303f58a-ea2b-4bbf-adf6-ca735c84e056", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b50af17-ec37-44c5-aff3-f43a595c3376", "sighting_of_ref": "indicator--63502d4a-db85-4f10-ace7-4465fb1a593a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdb68fbd-2324-4aa4-a13c-7ca7d3ebb630", "sighting_of_ref": "indicator--b77c8c46-ff65-455d-9617-bc85f6cac0bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05db8107-a7bb-4b81-8b94-5c266a3b0b57", "sighting_of_ref": "indicator--8efe4e88-89e6-4e79-8082-b8ce89c394bc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b5806fe-7d53-46a6-8c0a-da938fa17a6f", "sighting_of_ref": "indicator--8ca4d3ab-cfeb-4412-b7c5-d2e90fc2e52a", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9593f50-5080-4b1d-a9e6-76a12af55ce1", "sighting_of_ref": "indicator--3e3bf827-944f-491c-b6a3-d0cf2cb8fef9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d53211f9-49e1-4f96-8b7d-73ed0e5be090", "sighting_of_ref": "indicator--16373cc3-39a5-4323-9623-ae157986b745", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184261e4-1248-4b1f-af5c-50ba5330dacd", "sighting_of_ref": "indicator--6d5a3277-ca33-4110-bf02-44c09196631f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87b40a17-5890-4960-bc41-a71a4221e8e4", "sighting_of_ref": "indicator--52e8530c-8c48-4dcc-b742-f0290fb4baef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f10c5e0-a66d-4c25-a726-9153fd0774b2", "sighting_of_ref": "indicator--1b1f7c3f-9447-40b7-ba9d-09cdea9bbda9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dba83f80-c5a7-4c5a-83c8-3cbb3dd788e1", "sighting_of_ref": "indicator--53d8c0eb-cdeb-4040-8274-380b8ce74013", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f298fece-881f-4791-9edd-c5b2ad6d7d08", "sighting_of_ref": "indicator--a6451574-83a2-4886-89d9-6d83ef789389", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45cd48eb-9656-4768-9017-dde9c209efba", "sighting_of_ref": "indicator--1612816a-69ad-4339-a08b-8554efe8e242", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--371f3485-39d8-44a5-b512-78f9f5398b7b", "sighting_of_ref": "indicator--f38b4aca-d2aa-4063-b408-ffcaf9281e12", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e86a069-542b-42e4-ae86-56ea8f34bf62", "sighting_of_ref": "indicator--3f43b76f-d7bc-4abd-a45d-d359631cf9c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cce66652-2f8a-42bc-b984-ce1a25e8b49e", "sighting_of_ref": "indicator--ce659f41-efb9-46b2-a950-37d841de32d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--344fcf60-9de4-48ed-b399-bbefcb6583e5", "sighting_of_ref": "indicator--17db70d3-3dec-4c7f-8aaf-b3032acdb614", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fffe314-10f8-494b-9daa-d9bebc108116", "sighting_of_ref": "indicator--500c4829-08e8-48c8-9de6-f5961dd9c8ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f425894-0aa8-4938-a33a-6d1ef7c1a687", "sighting_of_ref": "indicator--245a3f9b-6c51-4f33-a93b-afe8361a948c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--919814c8-c393-45af-87db-d0a025a88e7d", "sighting_of_ref": "indicator--03a9fdad-0fcd-41b7-8862-972669ef0813", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f276897c-000e-46c6-84ce-bb7751fdca66", "sighting_of_ref": "indicator--1a55a57a-bafc-4d15-8046-4b7e4ba6a01c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3aed3c88-76a7-41fa-b25c-8fac919d5a37", "sighting_of_ref": "indicator--b42d404c-f8d4-4d5e-89b6-0d2e87a9978b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70681ddb-826c-4f63-a8ae-7651bc019df1", "sighting_of_ref": "indicator--7e1c2a88-f17e-4113-a3b0-17e8bce55c4e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a433da6-73f9-407b-a8d2-fadb48754ca4", "sighting_of_ref": "indicator--d058e3b3-b13a-4354-a22d-2924f2d802c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6e6326d-012d-46c9-a44f-b09be03ced00", "sighting_of_ref": "indicator--01b6b9e8-df6b-452f-91a8-dd750b8c9e85", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ee6941c-bbba-4493-9e35-995f41dcd30e", "sighting_of_ref": "indicator--ff4d17e8-be78-4786-8679-2015e3e417aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1d31081-ee49-4d7b-9a18-45a2679c3514", "sighting_of_ref": "indicator--6ad1be81-f5ec-4ddc-bc9b-1d7c92a77b07", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98de2313-9ad1-46b8-98ae-4a368f264df3", "sighting_of_ref": "indicator--596f3e55-c7b4-4117-820a-f0a3c17dcff4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceb96d5f-3e9a-46eb-b53f-8d1a3f63a205", "sighting_of_ref": "indicator--5dc392d7-a452-4f76-87dd-89d1d0221344", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca0d9df4-73a7-42a5-bf8e-e876a57bb6ae", "sighting_of_ref": "indicator--cb085b8e-f58d-4645-86ce-6d5b7286b4d1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fab0907e-bac6-407b-8d45-a9532f3e61d8", "sighting_of_ref": "indicator--94da9b80-cfad-449c-a518-050a51111aa6", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f7d2f3f-f9f9-4645-929d-5ff3edc85325", "sighting_of_ref": "indicator--22ab5e5f-b2bc-4e3e-a010-c1be496c9467", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--687f1c3f-b075-467e-aca4-68eb797bc34f", "sighting_of_ref": "indicator--530ca227-e34d-492a-a5c0-4c1cb4c6a86e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa5ed2d8-0c1a-47b8-ad9d-d28b51649111", "sighting_of_ref": "indicator--a07b2c1e-3e30-4641-b94d-dab6a2ebdc3d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--059f3037-9116-4f6e-903f-0f4c6f69c9c2", "sighting_of_ref": "indicator--14564db2-e049-47df-ad92-cc71b1635300", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed8ce436-c48f-47d1-b861-96bc5cf43899", "sighting_of_ref": "indicator--e343d8e9-4556-4500-8d27-df17180c3ae0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--753436f9-d2f6-477f-b632-590882e4c17c", "sighting_of_ref": "indicator--6c66155f-ffa5-41bd-a30d-b657b63ada8b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--398498c3-53b7-4cca-9e3f-6027dd3a1e04", "sighting_of_ref": "indicator--5815880d-eee5-431c-8d07-d7acefb76975", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6533aa7e-47ad-4e27-a006-46ec7c91f636", "sighting_of_ref": "indicator--4b73afbf-40f6-4a50-915b-50df2d39aad2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eff19c8a-1218-4801-a7c6-65de5565a61e", "sighting_of_ref": "indicator--3b46b20c-37f8-4a43-b299-4a27f98fc4eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afdf72ce-98b0-478a-a8cf-81603fa97d54", "sighting_of_ref": "indicator--12fde477-b848-4912-a2a1-6d206a051535", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--769bacfe-87f5-4ca2-8a66-e38627e108d9", "sighting_of_ref": "indicator--7ebcbfe8-fe44-4c07-b126-4189b9abf5ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2aaa822-3103-4662-84e3-5f8a0e8bc648", "sighting_of_ref": "indicator--4d7540ed-4587-411f-a15e-4fa834bc3df2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5850f94-4ca8-41e0-98d9-cfa05611a5f5", "sighting_of_ref": "indicator--11f3248b-ad26-4f3f-a052-f4df110930eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b338a8-508d-40c0-97f3-fcd96cf69dc5", "sighting_of_ref": "indicator--21caff11-263f-49f8-94f2-81f439194fa3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fc96f65-1af0-4c6c-8e9a-b65822e191cf", "sighting_of_ref": "indicator--c5393c3a-2b5a-424d-bdee-471046a1c89b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8375d78b-b718-4680-82be-4167e440919c", "sighting_of_ref": "indicator--cacedcb1-b5da-497c-aaae-7112275044af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eac16a0-543f-416e-aadc-e27df0440877", "sighting_of_ref": "indicator--24601f6d-6479-4a4f-ac45-3e7ee2425254", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--826e9dc7-4f7a-480f-849e-0dcae6beed53", "sighting_of_ref": "indicator--29a474c4-45b0-4a3c-b773-b0c96e97fac4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7babdda-b9fc-45f5-a7ac-86aecce930c6", "sighting_of_ref": "indicator--29a474c4-45b0-4a3c-b773-b0c96e97fac4", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c886a96e-7b08-41c1-9baa-0861e0547477", "sighting_of_ref": "indicator--21ef9a40-b2f2-4c28-9657-d583005e9806", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dc948a9-7d69-4d4e-90e0-85c6eaf7e77a", "sighting_of_ref": "indicator--166c0ab8-445a-4fbb-868b-21b20478765f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4057d870-8126-459e-9c1f-971ac0766ed5", "sighting_of_ref": "indicator--7929afd6-15e6-4491-b681-e4ef4557196b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9fa0e11-a2cd-4920-8b74-d97b9b5d41b4", "sighting_of_ref": "indicator--29dac5e2-873c-41f8-a083-aeac4385f3c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bf77396-f4c5-432c-aa48-4e212da17c7b", "sighting_of_ref": "indicator--aad68db3-df0b-4470-8e9a-8cca3af43862", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--756ffc9b-b82e-4774-bb57-48b703f2e492", "sighting_of_ref": "indicator--7c890d16-a226-4492-8654-b64cc2f199ad", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8e2f350-eef7-4fea-a00e-f327497895d6", "sighting_of_ref": "indicator--3dd218a2-da24-40e8-9db1-62cfecb3ed99", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f73e659-31a7-4d43-b448-a0fbca256ed4", "sighting_of_ref": "indicator--31ec3895-3145-4740-ada2-e9f9fec0ecfc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--869c91b9-025b-4b32-9c66-d8fdfc007ff0", "sighting_of_ref": "indicator--54cc4d9e-ffa4-4416-8ea6-8d7b6320f43d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b84808cf-dbc7-425c-94f3-bdfb2404994a", "sighting_of_ref": "indicator--6c6636f7-3c32-480e-bd6f-06f76037baf9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cc33f9c-871a-4b74-8c66-abd1c2f4589b", "sighting_of_ref": "indicator--b9101897-5344-466e-90e6-08f36f95005e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50b0ed0d-1787-4b23-8c0d-e97f4ae150bc", "sighting_of_ref": "indicator--a3eb2f54-2d38-4376-b050-df245077ba57", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6127c482-4f0d-44a9-8236-04b97794a796", "sighting_of_ref": "indicator--fd1ec12a-e373-496c-bda7-b3b7c3a59fb5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef1e8e16-8c76-46e3-b2ea-da90540eed48", "sighting_of_ref": "indicator--f4464e1b-3210-49af-9ccb-e360d089508e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1da6f2c-806c-497c-a4c1-2a4047de5f90", "sighting_of_ref": "indicator--1b976b03-73d5-4489-a631-8094dbf32c7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbdd25f1-be75-4c12-aa4a-37ae51dc9364", "sighting_of_ref": "indicator--2444a02e-bc3d-4000-817c-8ed38c000af6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42c15728-f47c-4e83-81e6-e016a48c9ff4", "sighting_of_ref": "indicator--f29a2ad1-de9d-4bf2-b94e-325665bf8cc2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13a936a9-a117-490d-8a47-44aa6ef8bede", "sighting_of_ref": "indicator--bd1e24cb-3066-42ca-8f3c-84b4a38b1af1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29afe3b6-6195-46a1-bb7f-2ab37f8e86a7", "sighting_of_ref": "indicator--3feba1f6-98d1-4b40-aaee-9e39209c7526", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8d3e07f-6934-4660-ba81-f5ea0f58418c", "sighting_of_ref": "indicator--954061a0-2524-476b-b325-251676a80a02", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--820d33f3-f47d-4e16-b59e-7a9d65391827", "sighting_of_ref": "indicator--6006ee47-96a6-4ffe-8350-ce602595bac4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19c421cb-15a3-4486-8849-722e4ad45bcc", "sighting_of_ref": "indicator--4ae6cc87-8b4f-4d48-9a6f-14aef347e1f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8974de31-fdfb-4982-8540-c9ba0aef4522", "sighting_of_ref": "indicator--8ed9be5a-1195-4001-9330-f6a1ba512cce", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e2c33ab-dc68-48ce-8a64-f489cd324131", "sighting_of_ref": "indicator--0956f976-b6ef-4c25-a44b-aac76308edcd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58cef9c9-4393-40d7-af13-a37647734d27", "sighting_of_ref": "indicator--3eb4c117-f641-4040-8d3a-510feeb4d0ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0e99ca6-dd91-4e9e-b7c6-48381aee1372", "sighting_of_ref": "indicator--abdb42b9-cbe5-40b3-9fb0-bde2bba0287b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed135246-87a9-42d9-97af-8c51636205a9", "sighting_of_ref": "indicator--af171743-1d9c-4044-a6de-ff24e8d02c1c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9afa44e-976d-45aa-9eb4-7c73d9f2f906", "sighting_of_ref": "indicator--16241797-43f0-445a-aad4-ab0f10dee0b4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a541011-3501-4d72-b3b3-ebaffc285554", "sighting_of_ref": "indicator--4f651682-1358-4076-885f-18194abb90e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5480b9e-3342-4f63-990f-d809130b2ec0", "sighting_of_ref": "indicator--f8b59b85-0455-430c-b745-ded350b00fd0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc3f0965-2d7a-4470-a5e0-f9644682dcad", "sighting_of_ref": "indicator--ae3253e1-3b3c-4237-a15d-96c9cb15a37e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ac32bc1-49a3-40fe-a0b2-637fa71c7151", "sighting_of_ref": "indicator--1f5fc28a-dd09-4a73-aa73-c679abb46088", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ca5ce54-602f-4979-8fce-cce8b9acc32c", "sighting_of_ref": "indicator--513b0f5b-b711-4834-bce0-13ac6dcfce90", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94a905bf-2b53-4152-81a4-c71b790fe439", "sighting_of_ref": "indicator--baf46adb-2451-438b-9718-4f7cf94283d4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d209690-733d-4eb0-8891-e5731c028da1", "sighting_of_ref": "indicator--fffa9e97-fcba-4bec-91a3-33372adb84ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71573960-011e-4486-a36d-70b6a47ac601", "sighting_of_ref": "indicator--da6a5ee0-d76e-4f91-8d64-afecc9eea716", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e30a0e5b-a3d5-46ff-b3f2-9a95c28a479d", "sighting_of_ref": "indicator--c440a33c-e22e-4b04-a9a2-766746d74867", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c4bfae-af45-4544-a3fe-8cac2475ca96", "sighting_of_ref": "indicator--f1a0a5cc-167c-47da-98b1-9150c13e3b31", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--917ac466-92c0-43be-9361-2cc170b79e50", "sighting_of_ref": "indicator--226369df-4fa1-4240-9150-10e485909a81", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--436e5c5a-f162-4acd-a08d-412760da908d", "sighting_of_ref": "indicator--59633f11-1a69-4b21-982e-0185cc28c224", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bad05e6-0cc6-4646-bb63-b1e737a3b8ae", "sighting_of_ref": "indicator--66c0727b-d533-49a0-ba21-bc3ee5660047", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38bf6d08-10f5-4b26-bf0b-eab43fbece2b", "sighting_of_ref": "indicator--479de9b9-aa68-4cd4-9e1e-4803f9a08ee5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c0d1c90-57e6-482a-85ce-cd54ef5ac07d", "sighting_of_ref": "indicator--b37ba4c1-e37a-435b-8ea9-4c1ae820ed40", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e18ca6b-3ad3-4f4d-9d0b-319915282927", "sighting_of_ref": "indicator--a81af731-0121-4881-a1da-42d8c116b5e0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37ffef57-cab7-4bc3-a46a-3a5f2988e8a1", "sighting_of_ref": "indicator--82905ac0-5070-4ce8-a2c4-208a99613097", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87851032-962c-4773-beb8-004a5b993073", "sighting_of_ref": "indicator--79854266-7431-47bf-afdd-fcb291c94e71", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7cebc0f-f8f7-4988-9421-ecd3e00f1ff7", "sighting_of_ref": "indicator--b6ad8979-44d0-42de-9856-1cb94fdd409d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64fc49cd-cd71-46a4-b514-d6ed14d7b7ba", "sighting_of_ref": "indicator--ecb9c9f8-3a5f-4e86-b8db-b57e6643e301", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--173be7df-b631-4d55-a111-71b6d1938a88", "sighting_of_ref": "indicator--721b005d-82af-40b2-a225-2bb89c03d325", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--533dcf51-91a9-49dd-9d08-9d5df3877846", "sighting_of_ref": "indicator--dbda5b5a-9577-4222-91d2-01934885f725", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0c3fe1e-b825-4255-945f-e60c012c51e0", "sighting_of_ref": "indicator--e4280e76-854d-46f1-b1bc-e3dde100f318", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f5af426-231f-465c-bbcf-8f1f3f88d472", "sighting_of_ref": "indicator--3d1c00a4-0980-4990-a308-cb642bace130", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4e4d85a-29cc-4b87-bef9-d527222e221e", "sighting_of_ref": "indicator--c7678040-e10f-440c-8243-2c707c1f3060", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dfeab1e-afb9-4268-b5e0-d91ffa5461e7", "sighting_of_ref": "indicator--40b24142-8c93-49aa-a1e5-b35749d08ea5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d772435-0af0-4466-ab3a-6a865e13a115", "sighting_of_ref": "indicator--c8ea911b-a4e2-4a16-9a91-3359894dd531", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19d377e3-b71c-4800-b351-822016b5a86f", "sighting_of_ref": "indicator--1291d9e6-d8a5-43a6-bc51-c6a716175f7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f48d4e7d-46a8-4c8c-b6e1-65a5e6cb6421", "sighting_of_ref": "indicator--41d1c20f-e769-4912-8c53-c816aa50a3b4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3345f287-9b56-43bd-9d64-cae644d89623", "sighting_of_ref": "indicator--4093df85-b093-49e5-b524-39a82e9bfc2d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3af78cc-fde1-4b57-8104-e14a49d7d99f", "sighting_of_ref": "indicator--b521db7f-c585-4caa-909f-d11d1266e067", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2af2186c-9d52-4a66-88de-99f319af14c8", "sighting_of_ref": "indicator--4beea254-22ce-4862-9f05-7412c9995e94", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa3e1978-c5f4-4dc9-91c9-95baa0f60d98", "sighting_of_ref": "indicator--264253ee-b6d2-4404-9b41-0888f8142ded", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3427dff1-93ea-4830-8209-fdf7c3278b40", "sighting_of_ref": "indicator--ebc40f43-8bd1-453a-b606-7cf60a2d9cfc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e63fc759-8ebf-4502-90bf-a2b203027761", "sighting_of_ref": "indicator--d02ba130-81b3-4808-a6c2-897c0de0c81f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54ac8180-37c7-49af-8c63-757dbbcd7fff", "sighting_of_ref": "indicator--e0800ce0-04bd-45db-8632-06d611f814d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d23f1d9-53a3-47df-a7ed-d7cc3aaf511d", "sighting_of_ref": "indicator--53a2e099-0a15-48f8-95e7-1195dc914b09", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--552462e7-9c4b-4a06-8b39-0774a385b78b", "sighting_of_ref": "indicator--5301236b-6df5-4868-8fe8-db403738cf7e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8605dadd-6c8d-4f74-af4c-c3c915ef4b0f", "sighting_of_ref": "indicator--6e0033bd-6b29-4a67-902b-8decdd81e695", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b96cb6e4-dba2-42b6-935c-8d3679442cd0", "sighting_of_ref": "indicator--06d9f358-5a92-4762-93c0-9d304645e97f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b992ea-f50d-4a66-8970-15872337a8ea", "sighting_of_ref": "indicator--fd498d61-3229-44f7-abf8-fd3a8d3158c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cee61518-4f0b-4844-900f-0caf01046472", "sighting_of_ref": "indicator--173da9c7-1a31-45e2-985b-4d3f60ced437", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c32ffe0-a082-4c7f-9a33-48a9df9a4ede", "sighting_of_ref": "indicator--b4900650-f194-4742-8f9c-7bb3edb6a39e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cab68c36-2bb7-4e0a-97e0-3136bb0a174c", "sighting_of_ref": "indicator--736e95c3-2363-4f01-b2b0-213942e901dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37ed4871-7c71-48d6-be2a-4b47c1df2bec", "sighting_of_ref": "indicator--d9b20524-f937-4886-ab67-e9dbe789a6e8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--474acd36-1e97-496d-b8ae-eee2599951b3", "sighting_of_ref": "indicator--a4809040-906a-47c0-9c30-ef8b1f44daf7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7daf9381-9c9d-4b21-ba8e-663aeb368f2d", "sighting_of_ref": "indicator--aa679349-59eb-4c6e-b335-97b2f51da2a7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19bc4381-e4f6-439c-ba48-d11881c83d04", "sighting_of_ref": "indicator--ad543e1a-5ef7-4929-9fc3-3198e8d0de6c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b73c73bf-1164-489c-a7c0-4126622305e9", "sighting_of_ref": "indicator--85831bc3-1e06-4682-aa5d-2e0db2105022", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9f5117a-ee1d-443c-a62c-2a97c1ff3ff4", "sighting_of_ref": "indicator--621a8048-9989-4d93-848f-c8aa6fedfbba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ba4df87-8b68-4cf0-85c8-80926cba62cf", "sighting_of_ref": "indicator--caea7fbb-ac79-4486-8a5c-5ffc01464f60", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4441cfeb-2074-4803-887e-3fedf27ff0bc", "sighting_of_ref": "indicator--1978dcc5-40b3-4069-8b38-658e9847a2e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e00e57ef-e8c4-42cf-ad1e-168e1f96e565", "sighting_of_ref": "indicator--dd3411db-3ab5-4f93-98b7-63da4ada36aa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c023dfdb-2f82-4f26-82eb-94a1a392ccad", "sighting_of_ref": "indicator--1047f45b-e927-4558-942a-7e5da5717e5c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cc7921b-e07e-4ace-8d1e-0a423fd38dd4", "sighting_of_ref": "indicator--c43c61c5-f4de-45f9-82bf-2b6b9b730d60", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bed55f9-ec56-481d-8a8f-71cb9b508e69", "sighting_of_ref": "indicator--53e885a0-5bce-4d9a-bb70-c558185c244a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd45b8d0-e320-45c6-872f-dafbc09d6bf0", "sighting_of_ref": "indicator--7955c1c6-a135-4b8a-aacb-9a2988ed832a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c47f726d-7936-489e-99f4-182d685743c3", "sighting_of_ref": "indicator--1a213f85-6989-4161-bf29-9cfd9b2c217a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--760047de-87d5-40c8-9af8-694ec1616207", "sighting_of_ref": "indicator--fc34b90a-4c2e-471b-bd89-c71e0e5a07fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a63947c-3c9b-43bc-a610-14bf0643002c", "sighting_of_ref": "indicator--11b28e10-ccbc-4070-af18-f868ee81979c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4554fcaf-6291-4ec1-b0c9-d9d123e8a9bc", "sighting_of_ref": "indicator--4909ffaf-c804-48c4-b5e6-233ae647c476", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59eff6f5-2df3-410c-9121-431fae02f13c", "sighting_of_ref": "indicator--5ba82344-f474-452f-b180-98101e1a70fb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c08a6ae-1969-4add-ab94-58bc1690e0cb", "sighting_of_ref": "indicator--00873b45-94cf-4030-9853-d112594a49e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8f5c655-e7d0-4415-9063-f86f3f4516dc", "sighting_of_ref": "indicator--473f7b76-87ad-4087-82a3-f0dee5d4ede0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--164e73b2-b26b-4c51-a1e0-710d5735be4b", "sighting_of_ref": "indicator--13e02552-1fee-47f5-9478-5f927a8d3ada", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b63d7075-ece6-4666-a6b3-9f303df07ab6", "sighting_of_ref": "indicator--cf9788b2-350e-4b6f-a82d-91928f37d2b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16a03c88-39e9-422e-8b92-33b26f575036", "sighting_of_ref": "indicator--58288f53-388c-4ef8-9fed-746136a3bb31", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0aa2708-d2bc-44f1-8365-5dfdde041faf", "sighting_of_ref": "indicator--f0deef58-e660-482e-95ae-b83d99b02373", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47da11a1-3c33-443a-84ba-0b5964cb77fd", "sighting_of_ref": "indicator--63dd66be-2a42-47e1-afc1-73e50617d1cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5edacdd-29b3-4704-bb4f-eb39070f9d81", "sighting_of_ref": "indicator--9cd00c2f-8071-4c88-802b-d7184b00d877", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76432080-5097-408e-bca9-b438b9586e4b", "sighting_of_ref": "indicator--d30c5b5c-1d01-417d-b422-4edc9941ca36", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb115833-99ad-4ee5-9241-6ecc7d96b56c", "sighting_of_ref": "indicator--13f818cb-693a-4203-9778-805afb03e3da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ef0135a-d4df-48ca-beef-b492f180f54b", "sighting_of_ref": "indicator--137cb117-5484-41bc-8db9-adbb66707377", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31d6edd4-da13-4df5-97ef-ded14b443542", "sighting_of_ref": "indicator--d35344cb-9c5c-463d-82e0-9ae8c16f2387", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9437cddc-70c9-42db-a424-334720f5de07", "sighting_of_ref": "indicator--baab5081-17ff-4c9a-b48c-dce044fb1142", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e2a9f4e-7953-4e47-baea-6639a46e60c7", "sighting_of_ref": "indicator--bd8d40a5-6887-4b4a-be8b-121c296d2213", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8252c010-3992-49e5-ba0a-b986c3df8781", "sighting_of_ref": "indicator--bf7480c8-9d25-4b6c-a55f-c660c305fa87", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fc50616-7c56-4a15-aea4-6c17d5d07cef", "sighting_of_ref": "indicator--76b433d6-3f10-47de-b385-ef14017e40b3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--775a5a0d-3ab4-4686-ac24-a2e9e46260a6", "sighting_of_ref": "indicator--8912b7b9-8557-4489-ab97-873ef8bf7482", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--386ca2f3-b5f0-4344-809c-c4775b336de6", "sighting_of_ref": "indicator--91249dfa-d446-4aec-8572-3743927ab626", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06dd189f-4254-47b0-bbac-a770f866d94e", "sighting_of_ref": "indicator--37d1febb-df0c-4a61-a9fc-9f0ff3f59b9d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44a3cb25-c974-490d-872a-4c6f720510a9", "sighting_of_ref": "indicator--ab29aa93-b20d-4cf1-994d-7299e4e2ac30", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--270fb71e-16c8-4704-8be4-659d0ca1c449", "sighting_of_ref": "indicator--8de5d46b-7bc8-480d-9af1-ed4948f6d319", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b158d8a-4766-40ac-b12d-06d728a01f09", "sighting_of_ref": "indicator--015e165a-e2b3-4490-91f4-7ab8ad875901", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28e9d092-86cf-49bd-b8a3-9bc36096c463", "sighting_of_ref": "indicator--79de2e8c-87d6-460d-b146-c9b1b04e48c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--141efbee-c7eb-4c26-b284-274644ddd3ce", "sighting_of_ref": "indicator--9c256ced-b296-47dd-a722-e2ee42ed8f3c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6f40260-63c6-49cf-98a6-593bfa9ab8b6", "sighting_of_ref": "indicator--b00f9782-2b14-4bf7-8fbc-7f331a99e5dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98f9d296-f358-4449-9d12-6b6f3abe6353", "sighting_of_ref": "indicator--4dd7615b-ad1f-4bfc-9cdd-b2d72bc75424", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1a5c026-9b4f-4b59-a220-cb48c853f431", "sighting_of_ref": "indicator--04c1476d-7c06-4b70-a522-db27114453b5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a439a1ea-edbe-4870-89d2-fc9b7a5242e1", "sighting_of_ref": "indicator--a5d2a290-c241-446c-b37c-5e39e1ca6284", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af2a1ed7-b953-4ae4-aea1-1cd41caab28d", "sighting_of_ref": "indicator--07185f91-92b7-47bc-82fb-9bbae82b9f9f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8843ddc2-d458-4407-a9a5-d987cc7848c4", "sighting_of_ref": "indicator--bcc64bb2-7efc-4433-bd18-465dd359c9b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be6ad798-f0fd-4fb4-beda-ce59795df667", "sighting_of_ref": "indicator--8c396f63-0f61-41c2-bad6-d0186e019fca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08f93512-344b-4827-8901-2c1156c0c53a", "sighting_of_ref": "indicator--6012e345-fc7b-4766-b310-999a60ebbbab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11a43ebd-18c1-4aa0-a168-1af8d0d6701c", "sighting_of_ref": "indicator--64d6a1be-dc89-49b0-8c50-5d4e8c3185bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--213f9673-ecb6-4248-8041-dc0eed70d801", "sighting_of_ref": "indicator--4fa5c4d7-7158-41d0-8aec-d4be5782e637", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fac591a-b702-463c-b166-01346404cc3a", "sighting_of_ref": "indicator--547f36fb-805c-4f7b-b4a2-c06436eb7e99", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e55cb3c1-5ef7-4a8d-ad54-449ac61aa8ce", "sighting_of_ref": "indicator--0a8ec5b8-447d-4200-8666-af6ede7add45", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa5e0d25-145d-4638-bb27-6eb3bebdc3bf", "sighting_of_ref": "indicator--83c3b974-1b7d-45f2-b48c-44919c183cec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d4ee06e-9497-4cfc-9a22-31e969f1c694", "sighting_of_ref": "indicator--571c0fac-c51d-4387-b1d6-e5bd9b044c63", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78b0ab9e-63ca-4018-b6b1-3610c501b5d8", "sighting_of_ref": "indicator--3674bc49-eaec-4a7e-b9e4-f6b82b1502b0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--957f3d5b-da5c-4de3-86d4-62526397a937", "sighting_of_ref": "indicator--bdc75a06-567c-4a0a-b8f6-6adbb9e88b1e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41f10e6a-07ee-476c-bef6-8e8c44054f8c", "sighting_of_ref": "indicator--66337d73-6ea4-462e-bb88-bb7edb77f623", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c9954b-c981-4f3e-9b05-62217209edb6", "sighting_of_ref": "indicator--558c4e3a-b1bb-4fb4-898f-6064e7fac72b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3457c536-815a-45b7-86f5-13a721ab0fb8", "sighting_of_ref": "indicator--0228eba1-a7fa-42e6-8ddd-0518b7cdaf5b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3024eca8-47f5-423c-8099-1d29432e9f7f", "sighting_of_ref": "indicator--cde87674-63ed-480a-93b1-29d77d6a1e08", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa2419b-ad74-4c6d-babf-c874f48d8c11", "sighting_of_ref": "indicator--94b82daa-b718-45a5-a3eb-8a3b55acbe34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4db0179-e83a-420c-92c4-731072aee447", "sighting_of_ref": "indicator--9e727204-c0b0-4895-8c1b-2d1eb7345924", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7b9431d-33cb-446a-9ac4-00331207e6bf", "sighting_of_ref": "indicator--4f4a6b19-54f2-4e18-bd00-94e0a881015a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--349e16e7-a707-47c0-be05-5d37178b770f", "sighting_of_ref": "indicator--d739128b-ac80-45b1-a0b8-b1053d1115d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b1c0d1c-eed2-460b-89dd-f6dd2d0c68ec", "sighting_of_ref": "indicator--f54d8002-4256-4c34-b8c8-f7c7387a3c6e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07c3f534-45c3-4fa6-8921-3b6a14722179", "sighting_of_ref": "indicator--da7856bf-b60d-4d79-bf87-2fdad6f0155b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f27b846-9801-4885-be72-d11c32b9d717", "sighting_of_ref": "indicator--ad3a25ba-9acf-41a4-931f-4161ac76aa22", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a96c01be-984f-47c9-90ed-4cf89b9e0ada", "sighting_of_ref": "indicator--9723c7e2-27dd-48f8-844d-15f3f6c8b2f9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--410cff34-6a11-4514-b28f-816b071bc331", "sighting_of_ref": "indicator--cb471fe5-5df2-47a1-a902-65352805827c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d70499ba-6637-43ad-a553-dd7122f0cce3", "sighting_of_ref": "indicator--e2e19fbc-eadd-44fa-be97-885d76ee991b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28486cf7-d31f-4819-a1de-e28543c7604f", "sighting_of_ref": "indicator--3cd7d46f-73ff-4969-954e-1d70e036e1c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54df80e3-db6e-49b3-bec2-37263cb82e91", "sighting_of_ref": "indicator--9f2593c7-503e-4052-9188-2af8ad0f4bf1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dea80c2e-26ca-4c4b-a75c-413f67051e82", "sighting_of_ref": "indicator--409a56fb-bc53-43a6-837c-dbe63c052650", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36d5a986-42fb-49e7-8f3f-f4abc72be12a", "sighting_of_ref": "indicator--cf43e3eb-6924-4bfd-8a28-3929bbaf229c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98cabace-0a6e-4f7a-bf89-67c844511f37", "sighting_of_ref": "indicator--b6aede53-9393-478f-afed-59d7439b1f64", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--930c66ca-d8e1-4ec5-9973-8159fa330b18", "sighting_of_ref": "indicator--3343c511-256c-4a92-9952-5755bd8c9b7a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50faaeef-f378-4bd7-91d1-aee25f20021f", "sighting_of_ref": "indicator--6efdcd29-33ec-49f0-93b7-6b5fc567c133", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a97b126d-b7b6-49c2-9c35-c01c4da69f69", "sighting_of_ref": "indicator--c2ec3145-f5ad-49fa-92c6-9b80efa2e974", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--134ff400-3c4d-4546-b929-ab699232800a", "sighting_of_ref": "indicator--86b1bf17-a53d-4790-aaa9-cd3a0a82d9cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87f87b38-5da8-4e77-b9e7-57c684ee6703", "sighting_of_ref": "indicator--0e959117-72bf-4fe3-95ae-3d4061c28928", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61c66d23-c6d0-48e2-8e56-a1f508d4390f", "sighting_of_ref": "indicator--da2b0108-7111-432d-a357-a251a69fc8b9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85b869ca-3916-4c3c-ae91-90cc60f46e7e", "sighting_of_ref": "indicator--e5f6cc7d-7109-41fa-a6a0-852edc973bc2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e067e42-94e8-4d21-8329-6dae9893e25d", "sighting_of_ref": "indicator--3fe367bd-82b7-4455-9ca4-c93d0d47a8bd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--349238fe-c99d-4530-b880-ee0add1fb115", "sighting_of_ref": "indicator--b37cb155-795b-46e6-a27b-0f89a0506d34", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee75a0fa-d24d-425f-bb7a-17f3bb14f604", "sighting_of_ref": "indicator--7a9f218f-7a16-4894-b287-9c4a601f8b48", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8736788-ce03-4df5-831d-5e2d3cfb6843", "sighting_of_ref": "indicator--6e1c3172-eabd-4861-8041-edc0dbf14b70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc8c2eb3-04e2-4b0d-81ab-c076d8f6f7ce", "sighting_of_ref": "indicator--1ba87624-78ec-49bf-a0ae-24c5597b3366", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a84ab058-66ee-4883-ae03-86ba70cb3126", "sighting_of_ref": "indicator--d38e8802-51a5-418a-b707-fb4a41ca80a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a5779f5-3c3a-4204-9600-0be54ddf4acb", "sighting_of_ref": "indicator--c42f8703-3bc4-4fb0-8783-bf2d7040ae6d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a73ea86c-95e1-4f18-a242-23edb6a43724", "sighting_of_ref": "indicator--20af586f-c133-4daa-93f5-f1063225af28", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f601214f-4ea2-4649-9f5c-6472d780e112", "sighting_of_ref": "indicator--8f4b808a-b19c-48cb-be24-5d02527eea1b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5071d0a1-893b-49f7-a6ae-8e912444755d", "sighting_of_ref": "indicator--ea885903-8880-474e-8d9e-f56ca35276f2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38c8abc9-b81c-47e0-808f-ae7cbb88d642", "sighting_of_ref": "indicator--2ff17c90-8e1f-41ef-9a8b-a7e783acaa77", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--474dc2cc-d8ff-4e66-9273-c90c2fe2e3a9", "sighting_of_ref": "indicator--618bb2d6-7546-4617-85c5-fc89593e1cdf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f5e2f70-1d40-4a76-a659-f84a53842490", "sighting_of_ref": "indicator--7ae9e701-2028-4bc5-b543-ea8072f01899", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21bad5c8-c2cd-4ca3-b121-88b5e512d251", "sighting_of_ref": "indicator--5a0621c0-1950-467e-a07e-d16a4d3b6882", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58a7b733-15f9-471d-8955-40563da6bb6b", "sighting_of_ref": "indicator--1b8fb425-a2e1-4ce3-8696-fee3d019d4d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beee2483-8943-4d91-b163-955125d802e3", "sighting_of_ref": "indicator--a9713a81-495b-46ec-9596-f8c0785b0d8b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--051ca95a-eba0-4aed-948a-0cb1f079f628", "sighting_of_ref": "indicator--0b2c1f5c-6caf-49c0-9a6a-cbb10f8631c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--175e5ed0-a8c7-437d-880a-160fae0c247f", "sighting_of_ref": "indicator--0a0b4ada-f174-4fc7-893e-3db7a28d6cab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1ec21df-7594-44c9-bc4a-9ac33a7ae688", "sighting_of_ref": "indicator--2a579bc9-bfb3-44bb-839f-3b2dfd40e36b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6adde2c-a1d8-483b-9953-b9d9758daab2", "sighting_of_ref": "indicator--6de8dbee-bb75-4417-93c2-bd2812ad27f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec1b702d-ec21-40e7-a49b-c5a8e1b2ce40", "sighting_of_ref": "indicator--dcd11208-a66a-407b-970f-d43acbdaaa91", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77650e8d-55ad-47ce-aa5f-f0618029afaa", "sighting_of_ref": "indicator--67f5ff97-a69d-4fef-a7ab-79dec3f56ee4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5563b3b-7aab-415c-96e8-cb654ed29182", "sighting_of_ref": "indicator--2dfccb59-f163-4f47-85fe-9d6768d1843c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58cf44f5-f1d9-457c-b023-86dbe52d6eda", "sighting_of_ref": "indicator--357aa6a2-4d9c-4d0c-b367-afaa6c840344", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--185c31f4-ce6c-42fd-a662-143179992b4e", "sighting_of_ref": "indicator--744bd5ed-102b-4a9a-a455-46d42413a03b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f5245bb-557c-4d35-86cf-1370a2361f3a", "sighting_of_ref": "indicator--5c38e8cf-58ac-4514-ba5c-91cc050b3e00", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04c1b771-311e-48ff-bd83-698528a29d8d", "sighting_of_ref": "indicator--50af1f7e-1999-4d5b-a24a-44fac7b81c59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b56a0c93-eeba-4d04-b288-e8b8ec918c7b", "sighting_of_ref": "indicator--e55cab78-df2b-4270-93a0-b516d11930cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd3104e9-223a-440a-8609-50ff245854ef", "sighting_of_ref": "indicator--2fcf461c-9637-40e1-8662-3b9973121a19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26cd3164-9e1c-4e9b-990e-28c7defd0350", "sighting_of_ref": "indicator--32e4a9b5-fb7f-48c3-b679-feeea710984b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1bd888e-d9e0-48e3-a00e-19b0272b5db8", "sighting_of_ref": "indicator--cfa0427a-f23e-4a17-84d5-d86a03b30fe5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9346c8de-d22b-41c5-9b2f-462d4528da09", "sighting_of_ref": "indicator--99770e75-4b74-4ba9-856c-6aae61158b03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--908d688d-d794-44f1-8be8-f0b0c7ac7739", "sighting_of_ref": "indicator--40a52801-3c2f-4d05-b1a5-385b2767804b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7056893f-a14f-4ae7-ab2c-0c877d6d875f", "sighting_of_ref": "indicator--b06b9725-8275-47df-8257-e3afe79f29ef", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de63790-844d-4726-ac45-6cb20c2c0b93", "sighting_of_ref": "indicator--d3b8410e-4077-411b-9086-8e7e137dab83", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a577147-f7ed-4179-b502-7d8541055ef1", "sighting_of_ref": "indicator--f5a3a171-51a4-4ced-a679-c03e04375863", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e17b70c7-a0c7-41fc-9b6a-669fdbb30a39", "sighting_of_ref": "indicator--23f89b11-89fc-4138-a37d-55c2777a8c5e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1a9344f-655c-4f83-a895-5271da423016", "sighting_of_ref": "indicator--eb2a3490-ae50-4834-9abb-56070e0fd83c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e28041c6-eaae-4b92-be55-a6d03c50ba94", "sighting_of_ref": "indicator--7705e650-a4a2-4f14-b7b0-9699ade03fe1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97616e67-8b82-4b47-a838-01727cc9569f", "sighting_of_ref": "indicator--7ef96fd2-6716-427f-b863-4e438699a423", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25c8ea7c-6790-4b71-a1f2-423e792f7606", "sighting_of_ref": "indicator--f3396092-b2ae-4abe-bb34-19f4e0dc4ce0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8d08a47-c058-4e86-8c4b-8b9366987ecb", "sighting_of_ref": "indicator--4237a841-a197-471a-b098-ef2ada33f0b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98217d6c-de4e-4d39-9dfe-66e1d5b9c27a", "sighting_of_ref": "indicator--308f53d6-cdc9-40db-9544-5d208bc5cad2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea36d9d8-4d77-4257-a9fe-895b8e1c2736", "sighting_of_ref": "indicator--3646a3f0-0e63-465f-9dd3-830f0556da3d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--727bcf1d-ee38-415e-9d00-cdc39254bac0", "sighting_of_ref": "indicator--4a07c71d-e2fb-4933-b592-561f09707c3a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ec0c27c-98f0-458b-9a79-3d16618cf086", "sighting_of_ref": "indicator--9a15ab67-9f2e-455d-9cad-edda07f0fd20", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eec88120-f1d0-4f74-b982-26c76ae0e28f", "sighting_of_ref": "indicator--654491b6-c9a7-42a4-bf42-d459d88354a3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46713705-5d7c-4ef8-b62c-8ec2d1b02973", "sighting_of_ref": "indicator--8cf39933-eb71-4f71-8647-ac0f32af6b06", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce528391-2b65-4aa5-8aae-578a2d062ce8", "sighting_of_ref": "indicator--cbca49ef-3d86-40b4-a70a-ee938144e6ae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6594d47c-c399-4ce8-b435-e71febed9130", "sighting_of_ref": "indicator--b1edd16e-0e98-4f49-a9fd-504a6cd5f059", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25b31adb-5afe-4f45-bcdf-5e4a49e4352b", "sighting_of_ref": "indicator--0b577850-e674-4fa1-ad58-ba677e831151", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da712eb7-8d86-47b5-961f-952f4703d4e6", "sighting_of_ref": "indicator--e52a2b88-7c64-49a3-8497-b19924a9a72d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66369e6d-f4b8-4350-99bc-eaa3ca3a5f15", "sighting_of_ref": "indicator--836d7d20-596a-4c38-808f-28feb49bfe52", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46784af4-f298-4940-ad9e-232ce2dfca75", "sighting_of_ref": "indicator--7e029ae8-7389-495c-bcec-93ecf7042eb0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a598883c-7b62-4b4a-bb8f-78ef635769c8", "sighting_of_ref": "indicator--1bb3d4ae-d118-4322-97b1-a6413fda1b83", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e73006cd-84fd-4c49-b803-62190563c626", "sighting_of_ref": "indicator--80425d78-5432-4148-aeea-8ccd78e81b77", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90d16731-fa79-4aa7-b61d-9919de0a9969", "sighting_of_ref": "indicator--835f33c9-d70a-4ee7-9101-87acc7fdff28", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61882630-9773-4329-b374-ce4fddd62c85", "sighting_of_ref": "indicator--9acbc3e5-1dcb-4858-af58-4d08c5c2256e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d0ff7c8-2372-4657-b8ce-1012c6ea0f9f", "sighting_of_ref": "indicator--20245f0d-1a2a-4b8e-abe4-b0098f38b5dd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48eaa00b-ee81-4dca-b939-4c8248547b76", "sighting_of_ref": "indicator--e4218731-55a6-4d7e-8808-4a4db7abb2a2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--660a8554-5120-4f3e-9f2a-022b0e1aac79", "sighting_of_ref": "indicator--179a9ce4-bd2b-41a1-b9f2-8f93890186c3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe6a2823-8dd5-4f67-a8b4-4a38ead94804", "sighting_of_ref": "indicator--30ec067d-80ef-4d10-8abe-b3864301a618", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--039d44a8-1911-492a-a1f6-04e8bf81547c", "sighting_of_ref": "indicator--4825ab03-29bc-4736-b1a8-e9b8312e5aa5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--460548c8-dc8c-40cb-98e6-a64c40b13595", "sighting_of_ref": "indicator--a2d2dfba-10d0-4f84-87e9-91bf9044b611", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1836b842-612e-4ca0-af5d-922ebbe8aa23", "sighting_of_ref": "indicator--648359b3-be06-4e0f-8767-b8183edc96bd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2461afc-90d8-4279-9dc6-be5982afecb9", "sighting_of_ref": "indicator--262f1b19-add0-4e5a-9635-0365f5d8410f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59e44d3d-1c24-4308-943e-b0ce0492b7a9", "sighting_of_ref": "indicator--cc9f78c9-a64d-4f71-af54-ce96d3768ef2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cee293c5-2bd7-4ea6-81fe-6e20ba53c370", "sighting_of_ref": "indicator--c0201a83-b234-4aae-83f7-1d0ed3485ae0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd706a6f-c83e-402a-b70a-8a7ab98dab15", "sighting_of_ref": "indicator--cc0df5aa-a27a-40fe-a40e-560d5442aae6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--819c6c4a-49cd-4d54-a2fa-2c7e748eb973", "sighting_of_ref": "indicator--caa9119d-64c1-44b7-92e2-cbe8bbbbc0e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07d67f0b-2365-4a37-a696-1d100855f121", "sighting_of_ref": "indicator--2542aa34-cba4-4c6e-8091-082b1fe322de", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ab2d88-f1ef-44d9-930a-d15ccd9a8b74", "sighting_of_ref": "indicator--7697cfc3-5f98-4b3c-9e51-463433745bd1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca671184-6fe5-481a-931f-8211cad99d84", "sighting_of_ref": "indicator--36df2d6f-3dbe-45fd-951d-f8874e726c47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ede146b2-0edd-41cf-bdcf-ef86abcd6a93", "sighting_of_ref": "indicator--25914643-bc5e-4a2f-9984-40842d416c72", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--792836d8-4533-4dcf-8ba5-1e91fb4be763", "sighting_of_ref": "indicator--024b9e67-cac2-433d-b18a-fd205056756c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd40de7-2a04-4102-bd71-24f8c748f5a7", "sighting_of_ref": "indicator--59a7271e-a7e6-41be-819f-643bde529c45", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b7fa7fb-1720-4a6b-825d-310c20c09121", "sighting_of_ref": "indicator--4ea6565f-ab08-4c05-b5a1-8b8131138a52", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f56ac345-a4ae-4877-8413-4f4e1dcc72e2", "sighting_of_ref": "indicator--0485d90b-8f9a-4596-adcb-b7eb103eb325", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6371a215-553b-4f9e-9928-68c601639769", "sighting_of_ref": "indicator--6c5a4c16-e362-4fb6-932f-fe804e84ee94", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20e07a01-01b4-4cd6-a962-3eba03cc777f", "sighting_of_ref": "indicator--2b167c99-8349-477d-a700-829d01606a1f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--382be31a-0ce7-42fe-a2c7-ed258c321e00", "sighting_of_ref": "indicator--d55fdba5-3709-4ab3-8c24-ec747ef60a8f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a40693b-fd65-4e68-a990-c96e1359c36e", "sighting_of_ref": "indicator--33a50cc6-bbfb-4974-babe-abff967b0806", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cddd35c-9637-4c59-9603-486584017e7a", "sighting_of_ref": "indicator--b4c1c854-23c3-4912-a930-eb51a340948b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--440fcf15-f69e-4b72-8dc1-cf680e4f7979", "sighting_of_ref": "indicator--f1de7f20-c648-44fa-952c-73fdd7c3561f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfd1971c-a9ce-460f-a01d-5bd1e9fb38c4", "sighting_of_ref": "indicator--90d93814-8937-4bc5-befb-e2e1993ea714", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3aea48f-f14e-450f-89b4-da97f4e7b695", "sighting_of_ref": "indicator--382772b7-a4e4-43d0-9721-bd802519f605", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b1fd88a-ad82-405d-a25a-1d0b0d3ad223", "sighting_of_ref": "indicator--7c485cec-a1ca-4fbf-900a-6a969820ed4c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1b46bf1-04a4-4ee4-bada-ff9b9cd9576b", "sighting_of_ref": "indicator--81d7f38f-7132-48ce-bfeb-a01c2b5925da", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca6b8c93-8e6b-4630-8f3e-898eb16549ef", "sighting_of_ref": "indicator--ef2496c6-78a8-43db-a886-d440f1e44895", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aee649b-922b-43b4-be72-dc83524d81c3", "sighting_of_ref": "indicator--c0091fb7-4772-4b31-85d3-bdd1159709e6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--150af0ea-cce7-4e03-9f34-98c78121b20e", "sighting_of_ref": "indicator--6005e7f8-9329-45bd-879c-7c97cf996e5e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a54477f-9242-4991-af42-dece840d8db8", "sighting_of_ref": "indicator--c9d33cc2-ecc1-4754-b378-616a93360ef3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c7d7b74-96df-45ba-b293-8d8499216c2d", "sighting_of_ref": "indicator--6c88af83-a104-478e-8bb7-d5222febb10e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50faf46a-157c-4edd-baf4-a736f86a5dab", "sighting_of_ref": "indicator--df11089b-9b21-4ebf-a4ed-83530082ae11", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a5fbeaa-d25d-4646-b333-3aed9b3a961f", "sighting_of_ref": "indicator--dcf9d972-343e-489d-90f7-cd335490da36", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e9571ea-0f6f-48d5-a914-6f9137cfd4c0", "sighting_of_ref": "indicator--d6840911-d0a7-45fb-bf9a-9ce31173b33b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a3c83bc-8479-403f-bd4a-2ceac0329933", "sighting_of_ref": "indicator--091036d0-4113-49eb-92ab-8acbaaecb858", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04387777-0d2c-437b-b986-5f6f6a265498", "sighting_of_ref": "indicator--def78c61-d2d5-43cf-b0bd-dacc2f35fdc3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75f6568d-44c9-45c7-8b0f-85b9bc2b5007", "sighting_of_ref": "indicator--499b22d7-7417-47cc-86ba-ccf2970f2b19", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ced6c0-c3e0-4727-b135-7d6d27391786", "sighting_of_ref": "indicator--66437f74-e12a-449c-a2fb-e3a90d49d20f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e97328-ed3b-421b-9834-c87fe27d2678", "sighting_of_ref": "indicator--45740999-d8e1-4bc5-8d3f-299db32f6e51", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28b0b6d2-5b63-4d2d-a18d-d88d5765093b", "sighting_of_ref": "indicator--80c1939e-b139-4967-8412-31df9bed80e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1ae7ec4-1035-4155-a4b3-9a0a351a0aac", "sighting_of_ref": "indicator--4ab3cfb1-2c83-4836-b064-2491debaf7f6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20708baf-b123-49b6-9280-8e0031c138ce", "sighting_of_ref": "indicator--d05a342a-e403-456e-ae9f-259ce60ffbbf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f3590f4-165b-4fac-813a-d8c35c548d1f", "sighting_of_ref": "indicator--7ba41d6d-e958-4d2c-a3c8-f32c4a5823af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a123b47-b9f4-403c-9d13-60f4cf07e377", "sighting_of_ref": "indicator--cfb2944b-647d-4c19-8a42-0859f7268df7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f85e132b-ab06-4b5b-98e0-67ebfdbf3b4b", "sighting_of_ref": "indicator--b78a6e6b-9b86-4446-9237-4df06c2226e0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--071e2be3-0f8d-47bc-8523-0badf1815d93", "sighting_of_ref": "indicator--b1e7ba67-4d42-4bc7-8b56-659a2bb4a1b1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cc17ee6-4a9f-4a25-bac9-1616f114bca1", "sighting_of_ref": "indicator--b5a7da88-3c66-458a-bf0b-49c061c1e30b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42bb35ca-a5a6-4d97-a7c4-884b99981057", "sighting_of_ref": "indicator--e1d24843-5aa1-40a3-a131-424af4d5f90e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f03615f-062e-456f-b7bb-01201afe2236", "sighting_of_ref": "indicator--b95d5916-f203-4365-85ad-14b7965338c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e23af0d8-3fab-4fc4-88ff-aea54207aa0e", "sighting_of_ref": "indicator--8104973b-fe12-4975-8893-2e6a8e9d9828", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b9e1c1e-1976-4628-925b-959451a11370", "sighting_of_ref": "indicator--36ccf1bc-8ed0-4d87-b45f-77478b5169cc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af14c328-00d5-4e44-be67-850f76daea4a", "sighting_of_ref": "indicator--fec981d1-269f-4e82-a33d-0155bf4fd9ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09714246-6be9-47c4-b36c-f712c396b26e", "sighting_of_ref": "indicator--94f5a776-b5c9-4a71-ac77-76914764aea4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--455b5626-0541-440b-ae48-ad0cc1215f95", "sighting_of_ref": "indicator--9bf90725-0e5a-4629-b113-5e469135ec68", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df825ef0-373b-46df-9533-b6115ee97c5c", "sighting_of_ref": "indicator--a2d5f05f-cf30-4417-81b2-d1e3090eb8a1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a96c1f17-c3a2-49be-af25-44ff5266f213", "sighting_of_ref": "indicator--affe4e7d-2caf-4174-a9b0-6bb58d7cd574", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68e33d5b-8946-4bf1-8e02-161bf5c73ed2", "sighting_of_ref": "indicator--d341d2ab-ed8b-4d44-9155-24d910a13345", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1c8b316-9a5d-4fd9-8eae-46b1f3df297d", "sighting_of_ref": "indicator--b8361231-0e28-4446-a4f2-94017c700126", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--037ded1b-c3af-4e8d-9f65-5746c43683b8", "sighting_of_ref": "indicator--68185905-4237-4085-8512-9bc2b850861d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a5ec103-8164-4a36-8127-5708638b4549", "sighting_of_ref": "indicator--904cdf80-7e90-4fd9-9310-78bf1f79d0ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e4e939a-bb34-4e69-a9cd-38c976974fe8", "sighting_of_ref": "indicator--e171792c-a902-40f2-8ec8-61231cedb762", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01827c86-2629-4dc4-b368-9aed25acdcba", "sighting_of_ref": "indicator--d1308341-c688-4fe5-8a4f-5fa8c0d08961", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--396cfa81-9437-4499-96af-5cc458a68078", "sighting_of_ref": "indicator--4fe73960-10bc-4831-a49d-a3959e253190", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aed67fdc-7cc4-436b-8f03-9aaf595dca0f", "sighting_of_ref": "indicator--af18be4c-a2f2-4e52-8f4a-bc48927846ed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19846803-274f-4b8f-9dea-ee1ce24bac1b", "sighting_of_ref": "indicator--9dfffcf8-847f-4d95-aad5-29139034deaa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a6ec3d5-ffe2-4259-a380-1754ca0a572e", "sighting_of_ref": "indicator--3cace368-6a4d-49fc-9c5e-aecd92cfbb7f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ce2efca-d741-42a9-8f50-3851d234324c", "sighting_of_ref": "indicator--9840392a-34be-4ecf-8e41-6f32eb2db091", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee1c807b-a0e7-4f3b-8f7a-34937ca86bdc", "sighting_of_ref": "indicator--ebd9d2a9-23f1-4e18-a715-8b78c156f900", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8367203c-d996-45bf-9725-30af4bed6de6", "sighting_of_ref": "indicator--9a59dc39-fa55-400d-b9fc-59415ac69247", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f1283de-25ff-454c-a231-1822cdef25d7", "sighting_of_ref": "indicator--f71c8efb-1a70-4d03-92da-f26a2dffbd99", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f4592a4-745d-4fee-98de-e90f65584811", "sighting_of_ref": "indicator--07562221-2950-41c3-9a17-81c2521da310", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64a3356a-b38d-4ca7-95c3-162eeab00920", "sighting_of_ref": "indicator--fe9d5896-6469-496c-8dd8-61710e4ddbfe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e026c6d-ec78-4cd4-a07a-df5ced1ab8d9", "sighting_of_ref": "indicator--a9c8b114-a6f8-4437-b97f-01e9ebf2804d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9c809a4-329c-4adf-aff5-4628a2c99567", "sighting_of_ref": "indicator--e2832b82-fd4c-44b4-bb86-a7471e49933a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c56ddaa-8897-4eec-be52-8b0494fb3526", "sighting_of_ref": "indicator--13f99934-a9de-4aab-b643-6f6b3a2f165e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32aa1c87-0466-4416-96cf-b5f52ae211fe", "sighting_of_ref": "indicator--562ef2bb-b802-4004-9617-f486d7897f2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--273d4587-b364-4d58-8540-fd98662fb4a2", "sighting_of_ref": "indicator--50b0d52e-e5b1-4838-9960-ac8976acee54", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6328cd9c-d23b-4515-a6ea-0693c090e42d", "sighting_of_ref": "indicator--ea119dbe-30a4-4072-a4aa-47d30ce440f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41a1a04b-6b67-4655-b5ad-025781b84aff", "sighting_of_ref": "indicator--072ed90b-d3d5-46f1-825f-0fe69b6e1f29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e86f1502-542d-4aec-8c20-ee97e53ee2e7", "sighting_of_ref": "indicator--e0623dc9-b243-48fc-8253-61b7945f9284", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bc9604b-4cf9-46b6-9e54-2d86ba5d42ee", "sighting_of_ref": "indicator--086b844b-3cec-4eef-840f-1e0d2f917f22", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2de206bf-e5b2-4bcc-8048-05702bc68bcf", "sighting_of_ref": "indicator--a6dd1f7d-181a-4482-a98d-9fbb93494d04", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78e2f713-c1be-4b72-ac23-5ea713da54b7", "sighting_of_ref": "indicator--96c2d9ae-a019-41c3-acd9-38604cde85a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bacc547b-5c00-4d9b-b4be-3f2a309dc6e8", "sighting_of_ref": "indicator--52983d67-f77a-4d34-94e6-7272e6069b09", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--997a57a6-6fe0-45e3-b71f-907bde8a4cf6", "sighting_of_ref": "indicator--8a63b6fc-a569-4269-8ec5-aac76aed9b74", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b70b9e90-b330-4fff-b046-b808546c04be", "sighting_of_ref": "indicator--609c3375-d8a2-4fdb-b200-8c4dde30697f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--105e142a-05fa-4c58-9852-cd4693c4535c", "sighting_of_ref": "indicator--960aebc8-52c2-4014-9d42-5230f6db3779", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6a01441-b0a5-43e5-8a3f-f70f6aa79c2e", "sighting_of_ref": "indicator--75145f29-a91e-4c66-af21-bcfa87c3e52e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3e3af53-ce4f-4628-990e-33b875f204d7", "sighting_of_ref": "indicator--82612007-9bab-410f-8d51-a53f6c567e59", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77bdbf36-72eb-413d-b063-ac85c5a39e15", "sighting_of_ref": "indicator--2945ff2e-5447-4938-99ca-ace4b3eff1b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f3e2dd3-2965-4331-8686-98f642d47b4f", "sighting_of_ref": "indicator--79c01960-36fe-413b-b952-4ad210292b4e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4742aa68-270e-40a2-8596-9d175ecd6fea", "sighting_of_ref": "indicator--966ca0c0-bed7-4af0-a3b4-76d123b7e5af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00d30236-1346-4726-8770-d7d7572cdb92", "sighting_of_ref": "indicator--bca1233a-9ada-4b0a-bd71-a6be7a51d351", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b14e1381-a66a-4dcf-b867-726495ce1181", "sighting_of_ref": "indicator--3f71d4c0-dd4e-44c9-95c2-b5093674b332", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e548dabd-aa0b-4f46-82de-8fcffcf41725", "sighting_of_ref": "indicator--5a1645c6-0212-4779-9596-c2b71058955f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b52478d-ad53-4c45-b2c4-ec6d391eccfd", "sighting_of_ref": "indicator--51a6008a-d90b-472c-95dd-c996d7ad2e13", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbcba724-d7f2-4ca9-9266-4f0ea0c72869", "sighting_of_ref": "indicator--fc4b9ac0-87e8-48bf-8c5c-c0c1ea439c24", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b66449-59f5-4870-aad1-9ae33a61dae5", "sighting_of_ref": "indicator--7031a9a5-2100-4f36-92bb-892a220826a7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42ffd7b0-f31d-4668-a2f9-ad4ee3dbcebb", "sighting_of_ref": "indicator--7031a9a5-2100-4f36-92bb-892a220826a7", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd269be6-79a6-4147-ad86-56bbb6b864d1", "sighting_of_ref": "indicator--0a739eeb-04ab-4c4e-92a8-8cb9f6a1fc96", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f4d58ba-5b6a-488b-99fd-4d394a116342", "sighting_of_ref": "indicator--adb1052a-e030-4a44-822d-912e10fc31d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8292f29d-2c82-40b7-9cca-ad02f45b1362", "sighting_of_ref": "indicator--792d3fb9-e71b-4e0a-be02-2f7158eccf88", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53c24331-9f87-4c61-9f08-b160d0d8b23c", "sighting_of_ref": "indicator--9640caf2-1c86-435f-a294-783bdfbf3a00", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deced8fa-6c7f-4696-b8e6-8e9c6dc30f07", "sighting_of_ref": "indicator--19baed13-7a78-476c-bcce-a4a6db167569", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08daf891-2f4c-439a-ab9b-b94e12433904", "sighting_of_ref": "indicator--19baed13-7a78-476c-bcce-a4a6db167569", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee5b073b-467d-4a41-87a6-a2b9173d87f8", "sighting_of_ref": "indicator--bd6d9fee-9bea-42d7-a12b-b9c963301ff8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6decc54-923a-481b-87cd-8be75a906aa4", "sighting_of_ref": "indicator--bd6d9fee-9bea-42d7-a12b-b9c963301ff8", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa64b340-32f8-4532-868d-d5a1d8fbb03a", "sighting_of_ref": "indicator--234cee7f-da56-4059-b738-311827e5bc2a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a97cb684-f3a5-44c5-b225-b07938e97adf", "sighting_of_ref": "indicator--6e9c0a4e-ec95-469b-b2d2-a41c00ecc9d6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e81126f-f4a2-448e-af91-23574dc1ae11", "sighting_of_ref": "indicator--6e9c0a4e-ec95-469b-b2d2-a41c00ecc9d6", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22d73b3c-6e2f-4769-b0f9-d6d85aad217a", "sighting_of_ref": "indicator--31cd21b7-cdd7-4f88-a136-486f51cc1d45", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aa5462a-6e3f-4c5d-bedc-87c437e973b3", "sighting_of_ref": "indicator--e608cc35-c9b3-4d6f-af96-c9e73b6dd4f9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--399c050e-fb28-439f-8431-ed163edfd04e", "sighting_of_ref": "indicator--973d527b-f782-4c5b-8228-f55029d46d91", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac65f42e-f13d-415f-83d8-fcd6ddee08f3", "sighting_of_ref": "indicator--c50456f2-facd-4a18-ac20-b72505509d1c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--912178d6-54c5-48af-8351-6db1edead9bc", "sighting_of_ref": "indicator--8614ae82-0ce5-42d6-8577-5787ac0515b3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65a15a9b-13c1-48aa-a7a4-0963632cca82", "sighting_of_ref": "indicator--33931926-74dd-40dd-8dd2-6a945dffcd6b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af5fdc81-06c1-4bdc-b69b-667119b0a08b", "sighting_of_ref": "indicator--10b9cd1b-3ea2-434e-8a38-5bb255468223", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef36672d-0d73-4b4c-8357-4c33f80fe922", "sighting_of_ref": "indicator--cf0f1f12-005d-4e8a-b7a2-d58544faf54d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dca036e8-8dc8-4b3c-b402-55674ec300e0", "sighting_of_ref": "indicator--a312d94e-4073-40d0-9e6e-4b970777c452", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e900d2ad-96f1-4eb5-acf4-af4a62d48ca4", "sighting_of_ref": "indicator--336ca4f4-570a-43b1-82b6-b951e37cb996", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddfc4bbc-531c-4146-bd66-e6e24b822631", "sighting_of_ref": "indicator--45243322-3a4a-44bc-9925-f8b89c1ed340", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a42ff40-1fbd-4e90-b179-77b13367231f", "sighting_of_ref": "indicator--10429da9-f288-4966-b747-225d6e58eb07", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cccc4f2c-dbc0-4d3a-9a27-7d2223943b11", "sighting_of_ref": "indicator--27261638-8859-41de-9950-419015e515bb", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a78ee710-ebec-4b23-9ae4-f18f9d11c467", "sighting_of_ref": "indicator--d2bcec94-8101-41a0-9f3c-e891bf44990a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4e4af94-0201-4fcd-a22b-d3292e19848a", "sighting_of_ref": "indicator--03128a2d-12db-4e1d-85ee-6f3982ee3827", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61198495-3a96-4206-a325-561675a18a3d", "sighting_of_ref": "indicator--cfbd767a-cb41-4f82-b6f7-55c250184fa8", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a470cc59-78c7-41f6-9f50-37fd307dbeee", "sighting_of_ref": "indicator--3f4338a7-450c-446b-97c6-602a4b972eec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6d77f33-dfb2-438b-998d-71fbba59c6be", "sighting_of_ref": "indicator--95919f86-4005-4d8d-a654-81aa188a422d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b222472e-d842-44e6-9b15-733c0e6e5469", "sighting_of_ref": "indicator--de8c052a-10ca-4529-86c0-838cd3868968", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbda17ee-62d2-4856-a121-a06fbbb2fbb2", "sighting_of_ref": "indicator--6c7bed9b-8996-4ea1-9f33-710ae702a06a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a72103a-b8b9-4630-a3a8-dca288c49b45", "sighting_of_ref": "indicator--f60619c7-6a42-4bb6-90d0-23f6c4273f18", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08a4b7af-7f89-4c11-a7a7-6c00bccca650", "sighting_of_ref": "indicator--a0a606f6-a802-4a3b-8b6f-02be2eaeb73f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10044df6-2415-4e26-a697-104296d594d1", "sighting_of_ref": "indicator--d3459761-46ff-4098-8e4c-540e65479b88", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52a3ebe0-b277-436b-88c5-b84490acc7d1", "sighting_of_ref": "indicator--64a88d3c-3c53-4deb-b5d4-e26c6ffc371b", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77f0cdd5-98d3-42a6-8789-4f9601c2ccd0", "sighting_of_ref": "indicator--308d219e-7e31-4863-8ad6-e9d4aa526995", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4e9e298-53ec-419c-8ca1-b05c20c66d3e", "sighting_of_ref": "indicator--809a825b-42d2-43e8-a0a5-3b53b0103eed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea697e8f-2e8d-4407-8670-c0d53bcbff84", "sighting_of_ref": "indicator--8eb14d31-f005-4050-842c-3fc9f03214e7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--478ac963-11b9-46f3-893e-41a1b8cbf60e", "sighting_of_ref": "indicator--835fd7a2-bcb9-47c7-8749-42ff1c43e8d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9460e984-442f-46da-84fd-f1facd82daa6", "sighting_of_ref": "indicator--3b40ebf5-24c8-4969-809d-9e03e4e8b94a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b861004-4e39-4683-aa23-f96c33e168b1", "sighting_of_ref": "indicator--e9b40cc9-baab-4aec-8049-f2f995316564", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffd1d30e-b519-40fb-ab2e-c05a17060c9e", "sighting_of_ref": "indicator--e9b40cc9-baab-4aec-8049-f2f995316564", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f333121-a37c-4d2a-9aff-4efdf7b73368", "sighting_of_ref": "indicator--28b8b9f4-6078-4b50-b2dc-01f3aeb5aae8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f34ce517-5b88-49c5-a19d-2f02d77ab9e4", "sighting_of_ref": "indicator--080a2fd0-7d03-4a8a-9b36-75fd0a993eaf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60e0d79e-ffc7-4e9a-ad0d-5d9153d5a6c0", "sighting_of_ref": "indicator--3c352fde-aa48-40fe-9d0c-8846d29aea64", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6df9523-23e3-426e-bc82-6ed735e28ffa", "sighting_of_ref": "indicator--f31c94a0-f043-4775-85af-b8a1a396d2bb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7d15446-98bf-48f3-96c0-e08e63087404", "sighting_of_ref": "indicator--f890a11f-e775-4c72-9e5b-754b9a60c07b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b0fa084-f75e-48f0-863f-87bb1cd3f0af", "sighting_of_ref": "indicator--c4aa3f06-aaf8-4ec8-b63c-48c908a552bd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f87f955-08c9-455e-8533-a5c287a76944", "sighting_of_ref": "indicator--7cd89b50-ea2c-4396-85b0-ce469a4d3a17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c669f24f-bca2-4b89-8bd5-83847bbaa32d", "sighting_of_ref": "indicator--49f63a12-3d89-4aad-b8f7-d64cddc820fe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfc676bd-b745-4be5-bc5a-3c8e6e724650", "sighting_of_ref": "indicator--a7033952-f3b4-475a-9aa1-60345390db32", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ebd2d24-dbef-40f1-83af-b5779679cf1b", "sighting_of_ref": "indicator--b22c3c43-70d0-4db7-9957-c8edd54ac4eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f353ed0-3711-48f1-970e-e35d4a7f3cd2", "sighting_of_ref": "indicator--ebd948a1-dd26-4527-918b-b241094fb56f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08e0ee90-9b01-41d5-87cc-b0feb1bcd3db", "sighting_of_ref": "indicator--de0c4faf-16ed-4bb8-8468-7f471f8a5718", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98333fe2-28d3-46ad-9d59-365bfff34b3e", "sighting_of_ref": "indicator--a81ef0cf-9d9c-4125-8f62-7f311b745a92", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e94e142-30d1-4224-a478-6c55ca52ac91", "sighting_of_ref": "indicator--bf30aceb-34b0-41f1-91dd-d3c6f8f6ff89", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad075036-a16e-4ca7-b702-d796361c9a65", "sighting_of_ref": "indicator--6acf5e56-5f9c-40ff-8260-4aead2466787", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7f90e05-d796-444d-b510-fccd8182b6e0", "sighting_of_ref": "indicator--16de91b4-765b-44ed-8e64-79e9b8789c38", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7f55bba-8de8-4f29-9fa7-2985b5f7a356", "sighting_of_ref": "indicator--1fb352e7-e0ba-4ee3-a1a1-169906f5d4a8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c609d221-aaab-49ae-8333-5cf859d4d145", "sighting_of_ref": "indicator--88e15bce-efc8-402b-9087-6a3a812c24c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9099307-81f9-4475-91f5-8b8241af0309", "sighting_of_ref": "indicator--b8776193-5f59-4e4f-b0c2-0c39993ef280", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84104f83-de55-4028-b2ab-de426a5365a9", "sighting_of_ref": "indicator--d1a90308-51aa-49b7-a571-7dbddf871ec0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54fb3124-f82f-4cf0-8f16-b9a1297af24f", "sighting_of_ref": "indicator--44526c00-103c-4af0-b302-9c3d641b112a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e1fb772-6285-4d5a-8617-aff397e45d69", "sighting_of_ref": "indicator--9fb6f04d-5e50-412c-b533-be732ed635dc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7209a35e-7a79-40fe-9ebd-54990992b5e2", "sighting_of_ref": "indicator--311db240-b7fa-481c-b2cd-f8462b430ff0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--424954c6-5ca4-4087-8110-d60572586884", "sighting_of_ref": "indicator--7b2a5b04-c84e-4a0e-ba7e-b5b27055ecaf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a4cada0-6c25-4598-8a9c-f00e87ffc75c", "sighting_of_ref": "indicator--811ca14a-f94b-4116-acf7-43519fc29b4e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bd7112c-4495-43f0-b28f-07639c6fe51b", "sighting_of_ref": "indicator--0bc35ee8-b882-428d-847c-caccc29b6f5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c9a4b57-ab9c-4e15-9b0e-2dc884236458", "sighting_of_ref": "indicator--c96e73e9-9392-43df-8a8d-e308b23e6a71", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--804deee9-1563-42d8-8523-a64244abfa68", "sighting_of_ref": "indicator--4a85bd43-2918-4611-9f3f-b38a4a9be3cd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d3cbc97-30e4-4e37-870e-0f517d36cb67", "sighting_of_ref": "indicator--bdb9d905-9fa0-4c33-93dd-47c775ecae73", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--867af8e6-ccd5-46ed-bb4d-3def95b9df79", "sighting_of_ref": "indicator--348f475f-ddde-4f44-a2f5-9956cc5de757", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--628a4c62-b12e-4a37-83ab-044201f4af52", "sighting_of_ref": "indicator--436786c7-4856-44d7-9c3f-1b1314d6a747", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ada16e7a-9a88-4699-90e0-321fb5f94f12", "sighting_of_ref": "indicator--21bbdda3-b589-4a6d-b789-3ee70ae76ca0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--522cee7e-906c-43ef-9c75-f3c68861580e", "sighting_of_ref": "indicator--12be6228-ec22-4cfa-81a1-86e22bf13658", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--631b55d7-d90d-4d00-8a1e-949f80462256", "sighting_of_ref": "indicator--db994d76-220c-4894-94c0-4d96b82a8061", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca137f9c-9ae0-4a25-bc99-d416701c64a6", "sighting_of_ref": "indicator--08f6e921-56a5-4f79-8828-9ffc85bbf38d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b60928b3-a0bc-4a2c-a19a-cd1e5c07d8fa", "sighting_of_ref": "indicator--fe294192-121e-4c09-bd4d-1e1fe362d708", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f5c5c27-10bd-4ddd-833b-dc73c85a67b1", "sighting_of_ref": "indicator--f1dc8de2-e5ab-4acc-b644-9a3d1ae99319", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e83a5396-c60f-4c94-81a3-dc0e4ba92bb3", "sighting_of_ref": "indicator--238656d4-6b92-46e5-afed-c74e1e1025ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7041359-236f-4e23-8bc7-0bc462f1d2b4", "sighting_of_ref": "indicator--a19e2274-eef8-49a1-b204-97e8f4981209", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9710d99a-41b6-47a2-880a-be3b69c9c174", "sighting_of_ref": "indicator--681d6638-5dd3-420f-ad9c-f77331019348", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da20c72a-226a-4940-9171-1da7b400777c", "sighting_of_ref": "indicator--d46a1b8c-ed7f-4c02-a5bc-1ae3707af4d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2405f65b-8151-43a0-a82f-14cedcf9cb8b", "sighting_of_ref": "indicator--795afcfb-1798-466d-bf69-74b655b0c84d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acd3400d-b021-48f6-a136-c0ccc205ca45", "sighting_of_ref": "indicator--4f590494-521b-4f43-818d-2737b22b28d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a70f32b2-201e-41a7-ab4a-8a838a4ee3d6", "sighting_of_ref": "indicator--dde6bfef-49a2-47be-b185-02627234cde6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f87bf770-5d7e-4597-8d7e-18f0b5018df8", "sighting_of_ref": "indicator--671ad937-815b-4f6a-ae7e-690a8d3fb801", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c8f2b11-cfae-4a33-856c-b58d6d1f34d4", "sighting_of_ref": "indicator--352ccf2b-2ad0-4a4a-ab28-b2d1afc2f77b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20116904-2cf1-4ccb-bbae-15d81e903fa7", "sighting_of_ref": "indicator--c9d2d5e9-2a4a-450e-9db5-0020cfe2b6c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e469dc2b-4f2e-4d1f-ad9e-a42a687f071b", "sighting_of_ref": "indicator--6c7b6333-0d9b-4faa-a694-5f3f41e2d112", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--772bd0a7-bf88-450c-9709-001f34b3ec56", "sighting_of_ref": "indicator--7b93403a-08c5-46b3-871e-1de8a43338e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--811a3918-2f79-45de-922d-698d13bf85e6", "sighting_of_ref": "indicator--69faa605-17fe-4cf0-a5df-6689b810a256", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1989304-f8e3-453b-a875-a52e17d66175", "sighting_of_ref": "indicator--1c043cee-23ee-4bbd-9999-ee88e18775ab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9730529-c187-442d-b436-db3fcdcf819f", "sighting_of_ref": "indicator--e6dff4a3-6559-4a54-b83a-72f6cf20a56f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--560c331b-2b7c-485e-8eca-9562ba21ecb5", "sighting_of_ref": "indicator--8ae811d1-f185-4eaa-9889-9a9d70e2de33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83da3424-4ebe-42e5-8fbe-6bd73a9c0684", "sighting_of_ref": "indicator--90ab6038-c602-4883-8499-27a03bced308", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a533257d-7e2e-4a36-b922-684929b90d80", "sighting_of_ref": "indicator--6037278f-2be2-4861-8ef3-88b5f42b8ef4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29b697d5-0dd1-4b2f-8b0b-ca5a3422b580", "sighting_of_ref": "indicator--435d117d-7902-47a3-b334-88e433472848", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bff48b2d-1b01-4d3e-8488-e5d0534af4a3", "sighting_of_ref": "indicator--e9304773-b555-40e1-b042-2cb641e3425e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c1e7099-8d62-469a-bb30-b4555a422df6", "sighting_of_ref": "indicator--401ef890-3cb4-4267-b596-7e3c6596fbc8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--040ccdf9-30d8-4de1-9b4c-59c44d0230d1", "sighting_of_ref": "indicator--43515fc8-dfc6-47b9-bf71-cf67d4e2521c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97d6f3e4-ef71-4160-8dd5-4999205be144", "sighting_of_ref": "indicator--6117ea07-53e7-4681-b9e2-91dc63c5042e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--987deddd-665a-4491-8dc2-9d44c342f765", "sighting_of_ref": "indicator--7e769227-b5f2-4232-a6e8-dfae9f69b24d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53d77571-baed-4f47-b4a4-cc63e6e6e46f", "sighting_of_ref": "indicator--f801ae59-72df-46a5-b23b-3d234b6ec5f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f6cfcbe-3e58-4890-ab54-c28a63250bea", "sighting_of_ref": "indicator--fad259d7-cfd3-4f8b-8958-dcfcc8053d1a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f83c93bb-ea48-4a22-b2c0-aa1bfaac090e", "sighting_of_ref": "indicator--04d7c0c8-1ec5-48ec-a30f-eacf5185795b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90851fbf-1aed-4f53-9bd7-d1f5bff7eb3e", "sighting_of_ref": "indicator--b5c9dd36-abb5-44ce-939c-e78c0984e6f5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c870ec53-782d-4250-b7d5-f1f466a80672", "sighting_of_ref": "indicator--c471d017-b765-407a-be9b-d252b65da630", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fe3c043-053e-4da4-a18f-256f1e3ca6b4", "sighting_of_ref": "indicator--e2754d34-42ec-486a-8008-cc0500253ee9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb37e04d-c9d5-42fa-836d-6921b34adca2", "sighting_of_ref": "indicator--9a409d9d-43d7-460b-a6c7-7e994ad8e180", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7942c434-113b-4d80-b138-44f0d899114b", "sighting_of_ref": "indicator--7fbc10af-7497-4051-a451-8fb97c828eab", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--403f5ca3-8112-4e12-be1e-6acf1c1f5ef1", "sighting_of_ref": "indicator--8bcd2ce4-5739-4c1a-ac0a-9e1cb14e07c6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b137dcaa-c69e-4d03-8ecd-2766bc37facc", "sighting_of_ref": "indicator--42d6aa88-4d6f-48c0-8ca4-d1a40d659b07", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c77df6c-032b-4522-b178-29a96fe4de32", "sighting_of_ref": "indicator--336a9d0e-b9bd-42b5-ad51-878ebe794664", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f5ddf67-04c1-4cfa-9b15-0ce32e9e529d", "sighting_of_ref": "indicator--f90fab5d-5ea2-40eb-bfb2-fcb221179b76", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--190eff40-1fbb-4936-a625-ec30049f8997", "sighting_of_ref": "indicator--e8f77770-53a1-42fd-973c-809b82e7fb43", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--643740c7-5505-4583-b867-940ade6457be", "sighting_of_ref": "indicator--fd52382e-5abf-4138-993f-264f70edec89", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--697a6939-565f-4550-8a37-242610750b14", "sighting_of_ref": "indicator--0f921a4f-5e16-4791-8c48-58836787ea21", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--439594dd-09b2-4131-b7e4-5c66674c7b46", "sighting_of_ref": "indicator--0933a186-4e50-43cc-af70-bc284fd3fb0c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4800e84f-257f-4bde-a2c9-cf0c8f3d35a8", "sighting_of_ref": "indicator--9ecb386e-c8e0-43b3-9b39-ba3be4fcdf70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b310b9d-34ff-4c8a-8195-9387f447aa4c", "sighting_of_ref": "indicator--30999571-1299-42d5-bdc5-c938811d52ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e1e262a-2a40-4aac-a622-bb832dc2dd23", "sighting_of_ref": "indicator--daa76482-7ef3-4e7b-90cc-f61fb84f3652", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84645328-154c-4bed-8511-2af01b122af9", "sighting_of_ref": "indicator--30234ad1-1136-42f7-9f9a-c4ecc0785912", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03d694f7-450c-4186-931f-fa88ad613eaf", "sighting_of_ref": "indicator--37c775eb-0f6c-4785-8c1f-70d6529541a5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f6ef9e1-2c10-4673-abb8-9bb3f6d7ded3", "sighting_of_ref": "indicator--5c9f4c8f-ef97-4d9c-a6de-c62693c8077a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98b09b73-de3b-411a-94ba-b2afaeb3a5d9", "sighting_of_ref": "indicator--3676bdd8-f202-4f39-89aa-751495c2041c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d75e17b6-8a0c-41de-8a36-e42cbd8f4d65", "sighting_of_ref": "indicator--26b12235-729e-4c2c-a344-5df573b96bd3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56d2ae38-6299-48b5-8b1a-85bf951d6187", "sighting_of_ref": "indicator--69cb6586-e591-4490-bb4f-9969ee035e8a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aabb49cd-a18e-47f7-8d7e-57c08fd1ed62", "sighting_of_ref": "indicator--049fd92f-7c3f-46c3-aba7-49a8f23e41b7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d044b7f-ee84-4f91-88e1-c08e0f92e82b", "sighting_of_ref": "indicator--288b64b7-18b8-4b06-b4fd-bd58d518231b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d18b5fe-a7e4-4cca-8356-06f964b1ed05", "sighting_of_ref": "indicator--892c5cce-fecd-45b8-8792-d4564b58c7d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1dfefac-2a57-45af-be4d-bba897239a30", "sighting_of_ref": "indicator--c8f28075-6c54-4b11-8d24-35eec3b49508", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d7f2577-cd94-43ba-b9cb-88be004a8c0c", "sighting_of_ref": "indicator--0c0077cb-1ec3-4204-a933-0ae4d1f6c49e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9cd4a98-b7da-40da-b30a-93451eabba34", "sighting_of_ref": "indicator--aa9575e4-2997-49bb-a0e6-d4a64c9cd4f7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1e56b2b-ce47-4924-ab1a-08a445210f52", "sighting_of_ref": "indicator--7ae8d6a2-2c90-4529-b32a-051f7511ebb3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccd2695f-0d3c-4c93-9c3c-3753f79104b7", "sighting_of_ref": "indicator--0cf68c46-1f4f-40d7-9563-c6ba6a07f620", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d736491-3567-455d-973f-1653eb5653b0", "sighting_of_ref": "indicator--2206885b-05b7-4345-86d4-b4bad010b0f4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7794abf8-f8cc-4a67-a1cd-7078a7109143", "sighting_of_ref": "indicator--417e1f30-e587-46f8-8e37-898f2297773f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4baa3f14-7b64-40b8-a407-7c38f18317b1", "sighting_of_ref": "indicator--eca7dae3-1f3c-42c2-b0f0-d3194f493343", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--436e10ae-dbb0-47f8-b7ca-3773b182f38f", "sighting_of_ref": "indicator--12ab234f-a163-4f4b-8aed-093bf57d82e1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f4e36a3-4255-466a-853e-798a97eec827", "sighting_of_ref": "indicator--ab4dc09a-b819-4c03-bc7d-e5ea1f826da1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2362683-06a9-4089-9f39-6ef713f56106", "sighting_of_ref": "indicator--4ae697aa-0957-4603-8ba5-af55e092bcfd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96c9bd53-3943-4d21-aa89-c23296d93c09", "sighting_of_ref": "indicator--4d873333-a9ee-4fa4-9528-d5c6bb426d00", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a16818-6a53-4d82-a751-ba64e1e66077", "sighting_of_ref": "indicator--bf54e6dd-7bbd-42ba-9690-7723b6ea62c7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fc2b24c-0454-4e7b-8fc0-c2c2998bd8d2", "sighting_of_ref": "indicator--a36915a6-280a-489e-b958-12ba3890fef4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2993163-fb5f-49ed-8d32-231291e4e157", "sighting_of_ref": "indicator--9e79c79d-c467-41ab-a66c-ecf359c509f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--373aff4b-7013-4b33-bf01-4142fe146ba9", "sighting_of_ref": "indicator--05ef0f96-4a38-4f8b-b4d6-c5f4e33f4aa8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--107bac04-e8f3-42b9-80bb-0bcc3dd6783e", "sighting_of_ref": "indicator--88c0872b-09ba-4813-afee-fe5aa8c94e3f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86b8162c-13af-4e99-aee2-6d8db8816465", "sighting_of_ref": "indicator--62e91885-1a4d-4736-8823-188c1f0231ee", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cfca0ed-6445-4bcd-a7c7-1fc9b49041e5", "sighting_of_ref": "indicator--e6f9d1a1-5049-4146-815d-d3621bfe11cd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68490e84-d8df-451a-9948-7a79ac4f6cb4", "sighting_of_ref": "indicator--8197bd42-8a1b-4004-9a48-c9d25b3c9c1f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56a999bc-7510-4ccd-9aac-e7665f826197", "sighting_of_ref": "indicator--eadb743d-0056-4f20-b6d2-f58e7372949e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73d1933c-4696-4513-bf26-86d54e7a874a", "sighting_of_ref": "indicator--de892dc9-29d7-424c-bf5a-2ceba5050cb1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ff652fb-ea03-4d06-950b-f85b076663fd", "sighting_of_ref": "indicator--12e88bd7-c1e1-4ac3-90ca-24425208c929", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a64ac93-64b3-4122-8f63-ab9d29751568", "sighting_of_ref": "indicator--c043c2ba-6af6-4a3f-8782-118e31827275", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64bd08e1-f0f9-4b31-974c-2fba7280feb3", "sighting_of_ref": "indicator--3e89be40-05ad-4ab7-9f73-e85cb5602f3e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44abb5ea-0c45-4c2c-b0ac-0d5719dae546", "sighting_of_ref": "indicator--cd9739f4-173a-4130-883b-f4aa84103e0d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02f8d648-5c35-419c-ab09-7f6135b0f4ea", "sighting_of_ref": "indicator--ddd894f0-1eba-41f6-82fd-cc68d7c81521", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cf0bd36-e041-4c8e-aee9-d1bd14732fcf", "sighting_of_ref": "indicator--581c2066-9edc-4e80-8945-5f82a2d90547", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09af1bf5-ac26-4287-8eef-848c89b5daa5", "sighting_of_ref": "indicator--2b5a0533-bb2f-4421-942e-25128a2e9e63", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b242e774-0536-43fe-86a8-e1b565145a40", "sighting_of_ref": "indicator--7fb6fec7-d4d2-47d6-a1b4-c79a2ad3d306", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da5b94a8-ee93-4020-83f2-b281023e8eae", "sighting_of_ref": "indicator--4389cf46-c3ec-4b93-829f-79189ce9a343", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11e11355-2b1c-4c25-b5e6-39d6c5fee02f", "sighting_of_ref": "indicator--6d0d1df1-01ff-4387-a7ba-6ee5b4d00906", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63aee9fb-4956-4452-bb24-10d8ff476258", "sighting_of_ref": "indicator--34be71f7-87ce-4945-9b72-b65de68d33f6", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a95f1e3-7135-4a11-8f6e-058a6b845277", "sighting_of_ref": "indicator--558e7a55-7c7c-41b5-80b4-fe1f48637bd4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72c2ac01-4ea1-40b5-9e61-ccd1afa7b6c0", "sighting_of_ref": "indicator--a1c12d04-84f7-4e69-b391-035c6d74720c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04b124ae-f028-4feb-8b55-c3901074c8af", "sighting_of_ref": "indicator--33bd6c26-b747-471b-a468-eccf4f77d1fa", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9338120d-4cd1-4b6b-8090-2d3ef8a53b4a", "sighting_of_ref": "indicator--5ea5ef5f-5f39-4fff-88d8-0ac78cceeb53", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bd529bd-5cc4-405f-bdee-f9082793a3ae", "sighting_of_ref": "indicator--051d8ef9-b1e9-4833-8e6e-beff692f340b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2734d59f-e7b3-4c6e-9798-738f582da9eb", "sighting_of_ref": "indicator--434b47b6-9f24-41b5-aff5-f6f5683d6df2", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbf0203e-80aa-42f2-93c7-ed1b63206f56", "sighting_of_ref": "indicator--6db0ff85-097b-43e1-94ee-cabada6fdbda", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--799111a0-1492-4016-af79-d7922caf1f52", "sighting_of_ref": "indicator--26e18753-3a93-4490-8a8c-b89d0326abf0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3e7367f-fae9-4a17-b895-18943ab92e20", "sighting_of_ref": "indicator--eda7320a-46de-4d15-842e-7a37085295a8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feb8c9e1-5eb9-4980-a57d-c688df41b37f", "sighting_of_ref": "indicator--0a7f8b42-5748-434e-85c9-33e6f1385dd0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37ed59ae-a20f-4fba-9a6d-b986067ed67b", "sighting_of_ref": "indicator--5ed58160-7c03-4213-ae1f-4f97b05b84e3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38b82080-5196-441a-b1b3-18eff6e69af2", "sighting_of_ref": "indicator--f2bb07b3-ef09-439b-9399-ae9adc7ec9d8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91a7dfe1-991c-4283-9ea9-677a157123ba", "sighting_of_ref": "indicator--0a7a19ef-690e-43d6-85bc-8da9c8e4e77f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--745b0584-839c-40e0-9959-3d3cad8ce3ff", "sighting_of_ref": "indicator--d16e92a7-9d77-4f28-88e3-d19aed85f767", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7270ca33-f73b-4e23-a7b0-a62c2fd804a8", "sighting_of_ref": "indicator--5a248aa0-64d4-45be-9724-eeb5bc1f4778", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf9e8ee6-a6b0-437b-95af-142fe0298377", "sighting_of_ref": "indicator--7d26fdcd-8c8c-49f6-837b-bda71e1e6bae", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6ce95e0-79f2-42d1-a39e-813cd9cb0289", "sighting_of_ref": "indicator--ffc34a0a-c9af-4555-a3c8-b52c0a8f8e5f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6a71991-f214-4ef3-862a-d3dd0433ff49", "sighting_of_ref": "indicator--6478ee45-103c-444c-838b-5e1bff393356", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6a3add1-7c88-4bb6-9199-64b9a5e47eb7", "sighting_of_ref": "indicator--7aa33373-7f86-4a79-b979-f95f2aa3c470", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05a9e9b0-f1b6-4a7e-90aa-44233b611895", "sighting_of_ref": "indicator--c1d8a0a4-aaa2-410d-8c4f-741f6dc55a41", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b139733-bc34-438b-98fa-08759dbbc8d5", "sighting_of_ref": "indicator--f0595538-eb9f-4d8e-9569-6cbede85b3e8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56f1edb1-0e78-4f95-a865-218c9acef287", "sighting_of_ref": "indicator--4b49af48-c7a1-4a8d-ba90-dd4d9b7d27ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1365fb8e-4c00-4446-b88a-55405fc3b4d8", "sighting_of_ref": "indicator--be0e8106-28f0-4498-9fcc-4a5263058768", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e08388b-65e5-4a96-9bd6-1278fe026e9b", "sighting_of_ref": "indicator--eed0a1f2-bdde-44fc-8cc2-f522df06ff2c", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cef9a28-9f30-44ca-9eb9-38eea17df3d3", "sighting_of_ref": "indicator--7851604a-52b7-44df-bb59-8c10d7ef1023", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fb49456-1330-44b7-8d10-79447a905342", "sighting_of_ref": "indicator--b5fa4fbf-02b5-4267-988f-ac7aa74a80f9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29222010-8226-4326-b54b-35cd482af0d7", "sighting_of_ref": "indicator--9c7e04ae-cbb6-4d9e-89d4-6308ba94103f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f620165-e7be-456b-bc96-6b3f33d2b6c7", "sighting_of_ref": "indicator--e69379a3-5062-4b8c-a743-5e83fb8a0d01", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--914c9216-bdf4-4f08-b0ff-8c3eefa8b4b0", "sighting_of_ref": "indicator--84aa2bd9-3f3b-4ce0-8f9c-3c6c0f6ba495", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee4205f5-dc4a-4725-a2da-f118c36b7d05", "sighting_of_ref": "indicator--5f157092-f681-4f0f-a21b-92a2656bb272", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90cfdfbc-7384-4add-9ced-50593cbcb524", "sighting_of_ref": "indicator--1212e650-2c69-467d-aa79-f986515c6dbc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d69695e8-3b61-4be4-baec-a2c76082a20f", "sighting_of_ref": "indicator--5c988b74-05b9-4129-95d7-6fc7b34b646a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ede73591-c98f-4070-93b6-239c086d9dc7", "sighting_of_ref": "indicator--efa7b94e-16f0-483e-9353-2274b5e7f188", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ffe66df-1d4c-4450-b24f-d59690fd66e4", "sighting_of_ref": "indicator--fcf00398-bd47-4c42-85f4-ab355413025e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fccda0b-6678-4e6b-a774-6b0f28523396", "sighting_of_ref": "indicator--293b6e44-6cb3-4260-b5aa-b2550fc0a5b2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5283db8a-510b-421d-878c-39c5589d160d", "sighting_of_ref": "indicator--57fb820b-874a-4939-b7f3-8e04cca07d99", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e86a432d-cd44-4c6d-ae11-73e1d8020ec8", "sighting_of_ref": "indicator--29b9a863-3bd3-4bc5-9b0b-0c5f5b078d24", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--201c77fb-b516-4731-a632-435b4f74a573", "sighting_of_ref": "indicator--1acca414-cb2d-49e3-a745-919876a195a3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87075eca-4e27-48d9-98ff-dded1d3c7818", "sighting_of_ref": "indicator--a37c114b-f0f5-449a-bf71-90aad6dcf360", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6272f69b-266d-4d94-a325-90c9c2b696bc", "sighting_of_ref": "indicator--3c9fd915-a79f-41a6-99dd-91e39789bf5e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--739ac174-786c-46f1-9196-e40e83e4a656", "sighting_of_ref": "indicator--28cebb79-0f36-4d64-958e-1e888393a0c5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a540da6-a75a-4cbf-831c-e11ccea8c29d", "sighting_of_ref": "indicator--f7594674-874f-434d-854e-0c149197102c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a7c8b35-c916-460e-804e-ae344afd2583", "sighting_of_ref": "indicator--4ff872d2-8aec-4663-8ff8-d1bf1bcd53c9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66ff4f6f-4130-418a-ab24-2a861feb8615", "sighting_of_ref": "indicator--f22bea01-d282-4bda-9434-8ddca508b380", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edd8ad9a-cc97-4c2e-8541-e903cec68c8a", "sighting_of_ref": "indicator--a8b0a0ab-0e43-46c1-aca2-dd91a5730d3a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e21ca087-f8a5-4b21-854c-3bc00767ba3c", "sighting_of_ref": "indicator--501d6e6e-7f3d-4220-b07e-b2fd3cccb87c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf3032e1-3df6-43e2-afde-79ed5c9088f5", "sighting_of_ref": "indicator--0659d66f-7642-46df-9218-a741998f537b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60813fdd-6f83-4cb4-aa12-9a772fe115d8", "sighting_of_ref": "indicator--f0e9c368-152c-400e-85c7-549e3a0669dc", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dcd493a-bfb4-4b7f-9ed0-5139ae870948", "sighting_of_ref": "indicator--5fccfdb8-5a61-4293-a5eb-7213e9535ce7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e06d616c-12ac-41e7-a550-10573f6d335f", "sighting_of_ref": "indicator--20ce58f5-a239-4da6-83e5-394c325c0aac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a5095b1-c090-45a8-ab9f-bb567701eb41", "sighting_of_ref": "indicator--80ab61b2-061b-4da0-828c-610c04bf4443", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa0bef6d-d5bc-484f-ab54-f225655333ba", "sighting_of_ref": "indicator--a6b40bc4-9b03-49b5-a54e-ad0a0c206fc3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--729c055e-caa3-491a-8664-9a75c11a33c9", "sighting_of_ref": "indicator--6212722a-bd67-4b9d-bc55-4dcf53af9b42", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67a85d4e-1c59-470b-84d5-8f7584b4eec5", "sighting_of_ref": "indicator--ccbf53e5-b5ba-4b1f-b0fc-ec0dd279e385", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14e0108b-6f43-40ca-80e2-cd2c1d466f24", "sighting_of_ref": "indicator--7b8b2e66-013f-4684-8311-57e95e7c7de9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a708af06-0261-47a1-8c75-956c77545113", "sighting_of_ref": "indicator--38f9b123-cb9a-4543-87f1-4c597a5d2074", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57fe90e0-d16f-4457-acc9-4ae031c6b0ce", "sighting_of_ref": "indicator--f115111f-e02e-4c46-8db6-87d064a6390b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d028d84b-7a44-408d-b674-9dad82aabe59", "sighting_of_ref": "indicator--f8ab2973-e626-4238-a7ce-4bbe107f9888", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c18edf89-d7bf-4c7e-9ce4-b033b243426c", "sighting_of_ref": "indicator--93e85e2b-cdb4-4417-8903-dd0fb6e2474c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94b61a09-2377-41fe-8909-8f7e34855240", "sighting_of_ref": "indicator--c153e797-db5d-43e7-a1b3-4cf0077739bd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0041f4a-0804-4e81-8fdc-bafd18cff133", "sighting_of_ref": "indicator--6393344b-0fb5-45ff-a5a2-f357c796af47", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd8c989e-e8d6-49c0-9f2c-e76a51b793a6", "sighting_of_ref": "indicator--417b2908-50fe-4acd-8b9a-08b95023cbbd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8035326d-1631-48d9-b988-79a3fe75a9ef", "sighting_of_ref": "indicator--20101229-d536-4a6a-b41c-8345b474babf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eb97bba-44ab-4d78-9ecb-4f11412d325f", "sighting_of_ref": "indicator--44830f51-1c9c-45e5-9f22-f18c550ece33", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bd50fd0-0038-41d2-aa59-59ef01475fc4", "sighting_of_ref": "indicator--02e1935d-f4ea-413c-b32f-b19d8b2dd247", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30e3d6f6-febe-418a-81a5-5c3870f267f2", "sighting_of_ref": "indicator--bbb35304-e9b1-4c37-9993-025037f104a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b12e2ce7-1d85-46ac-ad05-b71b9a6b079d", "sighting_of_ref": "indicator--1bb8cfde-df03-495c-8165-cf1b1d7e4478", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c96f6725-6541-4795-a41e-293b4381f9f0", "sighting_of_ref": "indicator--51c1a183-7376-46e5-9b9c-797c81a06ebe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0645676e-2713-4666-a4b0-babd649423ad", "sighting_of_ref": "indicator--3cf3d3b6-87bd-407e-b374-b9a9fb724f06", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a69a12e-b655-4abb-afb0-6d138871ed77", "sighting_of_ref": "indicator--ef8f4459-bfa9-45b8-8594-b7d90360d2a5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--322c8007-2c72-4ddf-9bd8-d146cf91f802", "sighting_of_ref": "indicator--f032b57e-6e18-4b42-a4ed-5dc0ae518317", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c31c75d3-4089-409b-8a16-3ecdb247b480", "sighting_of_ref": "indicator--4e83e32e-0887-42aa-be47-27a5434b91d2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ec1214f-6c9c-4496-a9b5-ff84b0caee8c", "sighting_of_ref": "indicator--90a4a2c8-b206-42f0-b254-4e31b59c99d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--454a7af3-32f1-41ec-8e88-3cd2fce70b17", "sighting_of_ref": "indicator--74024221-350b-4da5-be2f-fb3beac2a421", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1532cdc-06bc-4515-bbc8-f53a271bb75d", "sighting_of_ref": "indicator--5ebc36f5-c6bc-4053-83a1-a073b5d00e29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49d4fee0-39a8-4761-af73-74bddf010592", "sighting_of_ref": "indicator--8b6312ae-07cf-48ee-bd92-a28080edac99", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e6e5ffb-996f-4589-b750-7e429f6fbef6", "sighting_of_ref": "indicator--4d263e86-eae8-4974-93fd-3d9e7bcb92e4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bbadbc6-1b2f-4de9-a548-0953be45001a", "sighting_of_ref": "indicator--cc2cf030-62e0-430e-b091-340887f80746", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d24763e-1954-40a4-83b1-434b919f69c9", "sighting_of_ref": "indicator--a8c070b4-2320-4e46-b7d3-52a9a0219e29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28fd7b2a-bf83-4cae-9e0e-e245e2cbba17", "sighting_of_ref": "indicator--b2dc540b-3e0a-4c33-acac-e2699d176445", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--002c7e79-5d40-4f5c-801f-ab93a33e0036", "sighting_of_ref": "indicator--a6478400-a27d-4e51-a6eb-c0fbc8bd5d89", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a1eb832-e4b0-40d9-9459-3e1bb7c922f1", "sighting_of_ref": "indicator--9d635f8a-ea9a-4300-86b3-a9acfdb56896", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88613ba4-913a-48ba-842f-fa2b1a13b69d", "sighting_of_ref": "indicator--e56c792f-67eb-4f9e-85ce-0bd4e5e215db", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0ca27b5-862e-4fee-a1bb-65a4e8835c31", "sighting_of_ref": "indicator--d1d23492-01a2-4db1-9ee4-e9040d0bee51", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51cf921c-1ab0-4cc8-83bb-d8bd231d581a", "sighting_of_ref": "indicator--0a1cc0e9-8984-4ff4-b97d-d7db66a501a4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--257371e5-a88f-4472-a135-b0191a51fa32", "sighting_of_ref": "indicator--43c80748-2ff5-4a3e-be3b-dd5c11875226", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a4ba22a-38ab-47a8-b4a4-15b908a2038e", "sighting_of_ref": "indicator--6de5e5e9-427e-4925-836a-6d7725715dd8", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01a24ed8-0e21-429b-8766-1d9c30ea1a57", "sighting_of_ref": "indicator--df22156e-aced-48f7-be6b-de72a7a253eb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5db61f3d-f93e-44b0-8ddc-85c243d6a80c", "sighting_of_ref": "indicator--36199cd1-29f7-47b4-aff9-050bf45ce82b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c277fbb4-fbfa-4e32-9caa-471d33afbc5f", "sighting_of_ref": "indicator--9d413a39-e7b4-4bdc-9813-35a1658327b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c02f2f78-fce5-424d-832a-3413ffffcecb", "sighting_of_ref": "indicator--b5190f37-ea32-44c5-b6a4-465bcac7c641", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeac75ac-bf77-4b60-9069-f1f258d38386", "sighting_of_ref": "indicator--16a26174-1269-4fc0-9d97-4b667950aaa0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2dd1a44-f545-48c4-b502-92d2e0bee352", "sighting_of_ref": "indicator--7ab54bc1-656e-4efa-8688-34bf51c4ef82", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d9b0630-b9ce-4b9f-9d95-10e4e8b9b387", "sighting_of_ref": "indicator--adfe5c29-b0c1-48d9-955e-222ef18f717f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647f7dfc-3d6c-4bc6-93b3-ef683c4a5800", "sighting_of_ref": "indicator--da035ee4-f71c-4c82-8085-85e119846f7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59a73d6d-83c1-4edf-8f9f-65fccfb992c0", "sighting_of_ref": "indicator--09445c7e-df6d-453c-873b-db7c245a88bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ede4e9f-3f10-4b78-8d37-d95eb58a2d7a", "sighting_of_ref": "indicator--37ac1654-e581-4bdf-b2ca-0e9b3bf26fc9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4691284-3c2a-4d45-8a80-a08e709904e3", "sighting_of_ref": "indicator--686b12a7-37cd-4a32-9b91-bc65c5f74894", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b180117c-b6c3-4801-a322-eb6c5c4cb18a", "sighting_of_ref": "indicator--7460fecf-dd47-4777-a859-5d5536468238", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b2f5c53-416f-4d94-bf7a-9802853664d1", "sighting_of_ref": "indicator--2d1d17bb-09d0-4d13-96b4-90c932afe611", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3018c468-f0ae-4962-92d0-3f0e36dfc119", "sighting_of_ref": "indicator--150bdf3c-9d06-442b-ad03-55d1b318a278", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91dc9b90-da6c-4eca-93b1-a0d805367bfa", "sighting_of_ref": "indicator--5c0ce804-5453-4710-89f0-4db4410be8b0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25fad508-f06b-441b-bc80-61d7e41ef5d4", "sighting_of_ref": "indicator--cc7f0157-0b77-493d-b80b-c471a68f647f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da7dd5b4-03ac-4c73-b929-e6f478113873", "sighting_of_ref": "indicator--9e9890dc-35f0-4779-adab-7bc4958dbb54", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6810116-8640-4ec4-bddb-ca547c6305bc", "sighting_of_ref": "indicator--ec2523a6-30a9-4d9d-8418-649e2f1ea0fe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14533c8f-91bc-4e41-a007-64bfcc181776", "sighting_of_ref": "indicator--cd6c6007-36d3-4a01-90b1-cb6e0509d40b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea81f41-cfdd-4334-b008-8d34fceb234e", "sighting_of_ref": "indicator--2eb811bd-ada0-4f0f-b44c-75cf8c8700f0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36596dd3-7ac4-4f32-91da-77ddca283523", "sighting_of_ref": "indicator--fac40d23-0a2c-40bc-8c8a-096d330b8f26", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89c36ad0-3424-41ad-b01d-714ecd352ada", "sighting_of_ref": "indicator--ee19bcbf-8808-482c-8dab-edfe063e7d66", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b39690db-10f6-4d1a-b1fd-c442547a80c2", "sighting_of_ref": "indicator--3cf5db8b-1377-4b26-8601-3dbc6a48f53d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--453b489d-84eb-4435-a0e2-42e33a156860", "sighting_of_ref": "indicator--89684384-cdcd-4c45-a956-0e13eeecb401", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80ea0dd8-a055-4a7d-a580-fdd535814a86", "sighting_of_ref": "indicator--e372eea4-d44f-4a55-acec-5eadc980a850", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--440c080a-80cc-4955-9662-ea4add8eb588", "sighting_of_ref": "indicator--ac7a9bf9-ed8b-4edd-a744-0a03813c571b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69e65a80-754b-4bef-8ec3-36ff03e8c8a1", "sighting_of_ref": "indicator--3560fccc-6feb-47db-a650-fac26e4787ac", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--752baa19-33fd-4d2e-972b-c3861cf0f70f", "sighting_of_ref": "indicator--62e52318-383f-4ce6-9ce1-6db7d324ecde", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0e83d9a-065d-4f7b-86b7-b87ba7030e7e", "sighting_of_ref": "indicator--be83e774-8454-4f4f-9b87-57db2ec87e7a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7972798e-9eaa-4cb8-bc0a-baf069a09069", "sighting_of_ref": "indicator--04fd9360-5713-4f51-ae5d-ab112d33cdc4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f36fca3f-b03a-4f86-82bd-708e883a8a48", "sighting_of_ref": "indicator--bb549fdb-3bfc-4057-aa48-415fd5617606", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47a3285c-0770-45be-b510-3d3179612e1c", "sighting_of_ref": "indicator--a4544f11-18f6-430b-b5fa-e92499494726", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af2f0727-604f-4dfd-9c77-d10ab2a29afc", "sighting_of_ref": "indicator--274a8419-fff6-4093-9d1a-c8e91b7891f0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a795472-bef7-40f5-8d01-14af3a3e3870", "sighting_of_ref": "indicator--c75a939f-c6a2-44df-b939-1388f1f5e780", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27de42ee-5c87-4c25-b973-441b8d28865a", "sighting_of_ref": "indicator--dd49b006-c6c6-4d14-ab40-032c795b08c4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c5cbc0a-c305-42ff-bb67-4043cb1a0890", "sighting_of_ref": "indicator--030873f4-d71a-48d4-acee-09d8cdb0cbef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e342c79a-32dd-44e0-ad05-ecf78e7f6a9f", "sighting_of_ref": "indicator--c9d4e667-a208-4ce8-bcf7-6998dea54dc5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d7e262d-c520-4373-a798-534b522ac383", "sighting_of_ref": "indicator--c34c4141-8b94-4771-b793-9bdbcb1a9c0a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c68e6e7-d421-4bdc-b5aa-8ccaa016a9ff", "sighting_of_ref": "indicator--44d5de22-ef73-46e9-a9e6-1a43e1d06668", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef4d02c0-1156-4184-b45f-1d3194e54d72", "sighting_of_ref": "indicator--d4cdf3d3-0891-44fb-a00c-8cfa271bf313", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc5b24e8-44e7-4daa-9152-c3af5045e1bd", "sighting_of_ref": "indicator--e0733edc-fed1-4da5-b4b9-157f07e2aa62", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5dd08db-bbfb-4d0f-bb96-e8d5cb1803de", "sighting_of_ref": "indicator--7c0a75a9-9e6f-402d-af23-cbc046dedf13", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d732321-ec53-48d3-bb7c-c73c5f8a88e7", "sighting_of_ref": "indicator--af7d27b1-cbc0-4d54-b5c4-8b8b4365f780", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83f857da-ac59-40a9-956a-fc3a458f2736", "sighting_of_ref": "indicator--de755c6a-4a2e-40b5-8635-8a70d82a98ef", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aa1fffa-ac31-4ef6-b82d-22d0e21199ef", "sighting_of_ref": "indicator--64647802-75b5-4ea5-87e9-87bc3c77dbf7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82dbfff0-33e9-4075-b0b0-8338e1b8801f", "sighting_of_ref": "indicator--3b228213-4e89-4f9f-b945-59949bbfad7c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e571223-14ad-4c53-9617-5c4ebf282c27", "sighting_of_ref": "indicator--bd90c78d-466b-4974-8e97-6812a3bd4a32", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ba1b44-88fa-4311-acb2-b5f08b5aaa91", "sighting_of_ref": "indicator--16660ad7-d802-4454-9cde-b209fbfaa877", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e61ebdd-9849-4f7a-a985-39a595ffbe1b", "sighting_of_ref": "indicator--c28880b7-1c2a-41b7-8e82-b4864df1199e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--312d2d5f-5112-4035-a9a8-6b4210047d20", "sighting_of_ref": "indicator--a21fdd9a-17cf-4088-961e-65bc35f0b5c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af973063-3885-4317-bb24-72ed725bd888", "sighting_of_ref": "indicator--2e0a3b07-7ccc-4c82-9331-1530709c460d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa961da1-3fd0-4d7f-9a3f-169cbb2fd690", "sighting_of_ref": "indicator--ed9bd39b-0ea3-4f06-ab2e-2f68752e0864", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1d8b7a4-d230-494c-92cb-b6c891aa193c", "sighting_of_ref": "indicator--88ce5a3c-10e9-4706-ad47-0cff511a9bed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--832e2e75-935f-4999-bd39-38a84f1edc0e", "sighting_of_ref": "indicator--0bd9622b-a4b6-489c-ae75-4ec64cd36f78", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eb1005d-709a-4d62-bd7c-e9123959622d", "sighting_of_ref": "indicator--040aa470-72c9-4124-bf98-f8515535c319", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a14e7fb6-7f86-4c95-a377-29428aa18fa9", "sighting_of_ref": "indicator--9459397b-8581-4ce8-9368-e3f5d320153f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57db024d-9c2d-4084-90ec-d5f541556536", "sighting_of_ref": "indicator--99e9d6fd-712d-46ee-a246-6d1350ea1018", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71f218ec-2112-4411-b713-bc1f31d0aac6", "sighting_of_ref": "indicator--a4f84721-ca1d-471f-a24c-ab298c679718", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--218b0495-4c93-47c7-8910-82aad66ca576", "sighting_of_ref": "indicator--6c644abd-60f2-41fb-9db2-4f733af8ac32", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31913d8a-7dcb-4cdc-9fc5-170c64684281", "sighting_of_ref": "indicator--1a85b0a9-5bb0-4159-ab11-1dde72f64b29", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea782d65-1b3d-465e-92fd-513a7719d052", "sighting_of_ref": "indicator--2c179c35-df1b-4e87-bfc8-9676c75caeeb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd1145aa-b62b-4c0b-a74c-55763f62253a", "sighting_of_ref": "indicator--b13d68a9-21bf-4d05-84a0-44e0272ffd94", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--817cfce8-7bee-4883-879a-061286b815a4", "sighting_of_ref": "indicator--41180880-518e-4220-bf86-978dd155ca76", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35795178-4e97-4d1b-8742-0e06d1d39085", "sighting_of_ref": "indicator--6e53a479-0fe8-435f-a2f2-181531e5a54a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32c978e0-9a39-4779-92b8-f2f00301eeda", "sighting_of_ref": "indicator--8b80f657-a8ad-4903-8d46-a9dba072eac0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d742f3c-93a3-41b2-893c-fe042f45a0c3", "sighting_of_ref": "indicator--afad71a7-0417-4daa-84be-8c17625c2955", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57e451f2-030c-4dde-ab76-92f504d36828", "sighting_of_ref": "indicator--51798ab7-c921-4765-a839-a71ec85dbc05", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--586a87b6-7f3f-4a36-a3da-a59f77fd957b", "sighting_of_ref": "indicator--42d95c04-c863-4f23-944d-6b3b6403e237", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b19ed47e-6da5-4368-a5d7-82fd4a7accb5", "sighting_of_ref": "indicator--6922398c-5f57-4f0f-9fb8-de217ceac478", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--088a8cad-b78f-480a-9749-5ca67546baf4", "sighting_of_ref": "indicator--22e84357-4eb0-4c42-ba4d-46fa56b0e6d7", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1e38e32-4079-47e7-a454-870cb01f2e91", "sighting_of_ref": "indicator--0aa7d2f4-d2c8-4346-b8dd-13f51b2ac4af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6346392-c1fd-4ccd-b888-e697b26dc889", "sighting_of_ref": "indicator--fd917e69-69bc-4143-9e41-c1b4e9b822ff", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98d0a0ba-1a65-47f3-8b0f-3161d3c16160", "sighting_of_ref": "indicator--cd42ab36-eeec-4c31-8ae8-72ae2ffdbaae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb44a659-4050-407e-8fa3-a8259df7f823", "sighting_of_ref": "indicator--63bdd883-5fb1-4dcb-a1df-29028d1e8a70", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ccc534-6db3-4880-a676-81f5b7c2d8f2", "sighting_of_ref": "indicator--8500bbeb-21a9-4212-9081-32687a1e322c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b4f01e8-a557-4ee3-bb56-c3434a5826b9", "sighting_of_ref": "indicator--e5b53fa8-eb5d-4a41-ad96-c1550f0409f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--497ae187-4413-4fe4-abd7-e469071c41da", "sighting_of_ref": "indicator--cb424fb5-8f92-4c02-8e9c-7dda1c2bee67", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0c4b831-a37a-4b49-9a6c-7ce8b14f31d3", "sighting_of_ref": "indicator--ca049751-8039-4f96-b075-38e235e1d5f3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e3739b8-cb04-4522-9e5f-e247e6576305", "sighting_of_ref": "indicator--24a2f9dc-c863-4fcc-908e-5549ae00cf7c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35c0a06a-0161-4e65-a12f-575dad25f44b", "sighting_of_ref": "indicator--961e6f7a-eac4-4d15-80ec-899fe8c265b6", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a78ed0ed-ec39-4ada-8031-5d85c96fa14b", "sighting_of_ref": "indicator--282ffa02-e470-43bb-9305-557db3e39559", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c344f8-f6b2-4360-8318-4a569d6302e0", "sighting_of_ref": "indicator--d3cea376-7135-460e-afb1-5c13a1012942", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf63f1a6-4770-4189-bc85-2703bdb57125", "sighting_of_ref": "indicator--4acd9cc7-35ca-41af-b560-bc8197250bbe", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c52504b5-57fa-44d0-8044-6c7b754bd782", "sighting_of_ref": "indicator--41788524-8e4b-4462-8442-2d8991e334a9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4a138d0-3598-4213-8e17-bc02c3080f87", "sighting_of_ref": "indicator--64547b6b-2c89-486e-bf85-41b8a1e46aba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a390f8b-0dfe-4e29-9cc5-59bfc2d51071", "sighting_of_ref": "indicator--46c709c9-8cdc-434f-861b-7a934c311c25", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2267b5da-7643-448d-878c-a43f87e506d7", "sighting_of_ref": "indicator--12626c78-2a25-4e92-b29b-1cba5537df64", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71d87176-b152-4d4d-b7b9-9cb82b85e5bd", "sighting_of_ref": "indicator--630ecfff-cc15-4310-86cd-f16727d57fb4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bae586bb-3e15-4dbf-9ae9-08ebd6ca9dbf", "sighting_of_ref": "indicator--e198b269-a9d8-4c2e-ab29-9a8811fe14bf", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--410f8242-080d-408e-a3a2-26414df476a1", "sighting_of_ref": "indicator--14803a77-5589-4870-9c0a-94627e8031d2", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--428e8f20-a557-43e8-98dd-01f1cf10dbf7", "sighting_of_ref": "indicator--64075f62-a931-45d5-ad7c-c4c347a26dfd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--620d7594-e07c-405d-aef7-c48bf27a6e6c", "sighting_of_ref": "indicator--d4480733-c436-4d3c-b4ab-367298766dc4", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e83c2e8b-0bc7-485b-883d-4652be6febf0", "sighting_of_ref": "indicator--5e89250d-a263-4f4f-9ba0-102db8e2ca7c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a8fffee-dc15-4797-9b5c-b9090751d5de", "sighting_of_ref": "indicator--bbf4ed77-cf63-464d-9fdb-3de7136df404", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa62713-10ce-4ad5-9200-b8d66d4d4a0c", "sighting_of_ref": "indicator--8bcd38a8-888d-4d63-85ec-c71bd91a37bd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8a5f5c7-f90a-4d13-96ff-a9398bceb7c3", "sighting_of_ref": "indicator--f52057c3-30ad-4fbb-8596-bc29e4dd2891", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d385386-a2b7-4d3d-b0a8-d14ce57e271a", "sighting_of_ref": "indicator--02467ca4-2806-4586-90f1-425a905b39af", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ede8248-284e-4613-b0f1-9d92d0ae0695", "sighting_of_ref": "indicator--f4350bb2-13a7-4d69-ae57-c4906eeff0ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73bd6480-5370-4157-9746-88237be0a5da", "sighting_of_ref": "indicator--607806ab-c080-41e7-b793-40bce4ced114", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec44d62b-ddc2-441c-a648-aeb4dd0ff4ef", "sighting_of_ref": "indicator--cf510093-a1a9-4d26-8e5b-ac0a0c86fd4e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84037c8a-ab34-4456-bad3-3364deb924a0", "sighting_of_ref": "indicator--945e660f-0332-4005-a753-fa9e2d13ce46", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48b17a79-327b-41de-aa0e-ba20223eb9ed", "sighting_of_ref": "indicator--ab47ee10-6dea-4184-926d-9b4aebcc1b2e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87044812-cb60-49e5-8cc2-08fbef6282b6", "sighting_of_ref": "indicator--c9913180-fbe6-4fea-b342-f852548d1219", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3624c4-69b6-467c-81bc-c5039a60f8e9", "sighting_of_ref": "indicator--630d9bba-a80e-4375-8e9b-b47c3a5f67c0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78313d7b-f344-403b-84ae-9ec5f4c37793", "sighting_of_ref": "indicator--52b390ce-23ef-4054-8654-b1b7e4c5ba69", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d61a14a4-916b-4454-bc10-800cbe067fbd", "sighting_of_ref": "indicator--c588f3bd-bb29-48ca-964d-aaeb2c5ffe50", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b750cb34-b80e-49f9-82ed-40224fb0913a", "sighting_of_ref": "indicator--3dd18669-6e84-4788-8467-d1b355aac4ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd7b5fcd-388f-44a0-8e28-fc224b52edb8", "sighting_of_ref": "indicator--4adf4626-7a5c-44bb-8c06-f2f74e9797d0", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b22639ea-e496-4c2e-8573-0d3e8f3696b4", "sighting_of_ref": "indicator--6af6165c-0136-4de7-a722-693b1729f9cf", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a3b0eb4-f476-409a-bf8d-03a53dfdbbe3", "sighting_of_ref": "indicator--882c6231-7b17-4d61-a838-c59f43b568a5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31f4833b-26e3-4f87-a382-ddc688906d6c", "sighting_of_ref": "indicator--b17c1743-e019-47e6-a6e1-76ff07517cbd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e878969-0f30-4440-a660-0aa466113fd1", "sighting_of_ref": "indicator--b5dfda0c-0bb8-4671-bdc1-e98c47b65a94", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f44b0b-eef1-44b6-87b7-f55e611a50dc", "sighting_of_ref": "indicator--87bcbcef-7150-4797-b49e-8615fdba7dec", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03275ba3-07b4-4671-8388-73db6e7b5e38", "sighting_of_ref": "indicator--87bcbcef-7150-4797-b49e-8615fdba7dec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10dab701-d394-49b0-b4e1-915d248e1d3f", "sighting_of_ref": "indicator--9916acc8-cd3a-4b34-b5f7-e35ddfa45913", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce8b450d-a27f-4b08-968d-a6dc9e57d446", "sighting_of_ref": "indicator--73dc2b49-ad20-4993-8c7e-bc7151edeeed", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65c0e460-0bfa-4a5b-8b8d-cf7edd6a7484", "sighting_of_ref": "indicator--fdfbbb5e-685f-40e7-924a-84ec3e924f84", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3be1bed3-2e5f-4873-9665-4a160f7214c4", "sighting_of_ref": "indicator--ca37794f-f350-44aa-8dea-e3cfefd4dd7d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43fc5268-eae7-49bf-bf34-046ca0f2489d", "sighting_of_ref": "indicator--55f2914e-5d5f-4d7a-a37f-3d94b63c2798", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0598a4eb-942c-4353-8241-9201e5cd5770", "sighting_of_ref": "indicator--091f37f5-bbfd-422c-b3d3-ab38beffaca3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58a681e6-a28b-4b10-bb1a-9be31275650a", "sighting_of_ref": "indicator--915b4527-d852-424c-b903-d7dc69218ad9", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6677cb28-c2f0-4145-86a7-69c026c9f333", "sighting_of_ref": "indicator--d84dc799-bbf8-440b-b229-72c699f01280", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bec21ad9-12cc-4fef-8109-6d1a237ab534", "sighting_of_ref": "indicator--0661ea24-7ae9-4036-bb4a-adb39ad014ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f8fc851-eaac-4367-9f00-80e5a799d5bb", "sighting_of_ref": "indicator--ea77a003-3130-4b47-87fb-e00dca12d695", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--553e0627-01fa-436a-9d59-7a50aed02e66", "sighting_of_ref": "indicator--83564cd8-acba-4d75-a810-8518d1cadbfb", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d977086-e06c-4a21-9890-6d09a7c4c1be", "sighting_of_ref": "indicator--5981f98e-dd8a-4923-8d79-70db95740df8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0639d5f-1aaf-42ba-b16d-0714aecac432", "sighting_of_ref": "indicator--2e26d046-d7db-4e5a-9fc6-0deae8e2fce5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28637927-e96e-4d23-9afe-bc525ae65c10", "sighting_of_ref": "indicator--b40ac746-37ed-47cb-bbaa-2ada4dd83111", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b924a8f-a6b2-4b5f-9c60-ba53381cb5c9", "sighting_of_ref": "indicator--5fd8c953-7b0d-437c-8344-1b3c62d6d2ae", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c304ae9-233a-4d87-b936-17c4ef889296", "sighting_of_ref": "indicator--904ce209-81e0-4ffc-a614-03ab53b7d4d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d737ff62-4fb4-4c62-a27e-9c1eaff1126d", "sighting_of_ref": "indicator--82a191f7-4d6a-4a0d-b0f8-ef972b0fa7bd", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a4e236a-e629-4c7d-befe-ab38c143b242", "sighting_of_ref": "indicator--fdbae1ba-699d-4431-87a6-f2bd29a58da5", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3d8ede0-728b-491c-bc69-a18f60d8e73c", "sighting_of_ref": "indicator--f0a7045c-35c8-4311-a5d8-eba1f6bb142a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d80520e-cf6d-4883-b895-ac018b0ff5fd", "sighting_of_ref": "indicator--84d04d58-8418-41fe-9cce-8eef4d2f85ff", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b24fc9e9-208c-42bd-9267-24c65a624373", "sighting_of_ref": "indicator--2fa64bb9-aaef-4c17-8d7b-451e6c35aa58", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f29e628c-b17f-4956-8517-54dc4aee1deb", "sighting_of_ref": "indicator--7f653cf3-5aec-4e11-a3f6-28a14484391e", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31a5b3d6-0a0e-41b2-9875-d7eb3245dbfd", "sighting_of_ref": "indicator--3170f6c6-c115-4b05-8f6d-a3d1f1d20f44", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d17f6ec-7337-4e98-854a-46e0e0bd5258", "sighting_of_ref": "indicator--a1888d3d-cf2e-4c82-940f-f52a1fc634e5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--034fe2fe-f6c0-4fa7-8ff7-8627c34de1ab", "sighting_of_ref": "indicator--3e816394-fee5-455d-bc6b-35bf2c1bf90d", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1a4ff42-7fa3-4a7c-a79a-2a89bd189a4e", "sighting_of_ref": "indicator--2d5b37bf-df9c-473a-b228-9c3460bf2e6a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d42b9c4-9f12-4537-9ff4-d0aee5dd6978", "sighting_of_ref": "indicator--51b67849-3333-4d36-a4d2-024bfae018ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f7f3539-3215-418f-b2cb-05a4f57b2311", "sighting_of_ref": "indicator--e0cbf0b1-8e44-40b3-b1df-0f6fe34e0ace", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc17054e-1f18-4a45-bf09-4b744dcc82f8", "sighting_of_ref": "indicator--e30904ff-fd98-40cb-a57e-d976e6bb17ec", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca67619f-9069-4943-9f49-af1f667c8cbd", "sighting_of_ref": "indicator--db303a58-3ab9-4384-96ee-ff72195806e1", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bd12962-b329-4d88-adf3-923fc96d3c63", "sighting_of_ref": "indicator--58bb8006-fdec-4e8e-a102-f3605de35abf", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72b30b5c-bdca-4f54-9cab-956882ea0feb", "sighting_of_ref": "indicator--72c3846d-f673-4b12-a704-f17792caa0e1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87ca7630-720f-4cee-b931-f0336cbc4bff", "sighting_of_ref": "indicator--91e2ed9d-7aaf-4f96-816e-30490619892e", "where_sighted_refs": ["location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8533665f-f604-486a-9f6d-5a7b1200224c", "sighting_of_ref": "indicator--91e2ed9d-7aaf-4f96-816e-30490619892e", "where_sighted_refs": ["location--a9163243-55d6-4d38-8102-2aacd520db83"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c10cd281-18ec-4e74-97b4-fc1b3a63c82e", "sighting_of_ref": "indicator--2c85c8f1-9225-4ce2-bcc9-c368ff8bd29c", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--108edfcc-d456-45a9-b675-07e8257d9b83", "sighting_of_ref": "indicator--8f2e8ae7-e82a-4b24-8862-13b4fd5d48ca", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f543bf3-aeb6-4bd5-b857-e6e8d9b59857", "sighting_of_ref": "indicator--e6310092-3dbf-4491-a1cf-fe550d061c3a", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b02f8396-16d3-4fb7-a8d6-3a109e0f1d10", "sighting_of_ref": "indicator--700f92b9-8b42-473e-8f74-b97efd309f03", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a02e114-23d9-423a-80c5-acebe63c2caa", "sighting_of_ref": "indicator--d9c8b01c-76d5-4fc5-8c2b-130a5b3b82ba", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3db1304f-2d57-403f-9a4f-7bdbb46a1c0f", "sighting_of_ref": "indicator--34d60425-fcff-42c6-b6f8-e7d89dda78a5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0bcc92d-0aa0-4a3b-8b08-3e2cc78f7622", "sighting_of_ref": "indicator--5e4ae9ba-3512-4c58-910d-f059f03e8ca1", "where_sighted_refs": ["location--cf340c00-42b1-4f2a-a395-00f0b94b9f08"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e743ec4-9d02-4a7c-bc28-1e2d22fa1ccf", "sighting_of_ref": "indicator--1ba2e1b4-acf8-4116-b518-540c537a210b", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ca44494-359d-4a74-94c4-aaebc621a30b", "sighting_of_ref": "indicator--7e1d6fde-1b5c-4ffc-b71b-88098bfa33f1", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba4c6adf-062f-4694-b33f-ae7a1459179c", "sighting_of_ref": "indicator--942fee6c-59ea-41f5-9012-1bc9f0626964", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--138ea6b0-0e4e-407c-8d9c-15de678e0990", "sighting_of_ref": "indicator--e8a32372-ae49-404d-a458-cc5d14e7d76f", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f62c1e1-91dd-45d5-ae88-13b5c663faf3", "sighting_of_ref": "indicator--860c1289-6329-43c8-aed3-dede7147f2d5", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85a51012-0709-4ff7-83f9-11086f2f0766", "sighting_of_ref": "indicator--9f4b6416-09ec-4d44-bbfc-e549fde5e301", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--269cfe09-8bb9-4dd4-a55c-72c16131593e", "sighting_of_ref": "indicator--a4b93b23-89af-4b41-a23e-31721e2f34d3", "where_sighted_refs": ["location--db6d2d8a-77c3-4583-91c2-b1b98217395d"], "first_seen": "2026-05-28T00:00:00.000Z", "last_seen": "2026-05-28T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--89546ff5-18ce-420d-823f-84011dd96a92", "name": "Threat Report for 2026-05-28", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-05-29T11:00:01.567Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--0d543f1a-2b9f-4243-bc2f-1cdd363bfb15", "location--a9163243-55d6-4d38-8102-2aacd520db83", "location--db6d2d8a-77c3-4583-91c2-b1b98217395d", "location--cf340c00-42b1-4f2a-a395-00f0b94b9f08", "infrastructure--4d8f6f09-74eb-4a26-b872-5c3beac79aff", "infrastructure--cca27f04-b20a-42a3-8860-456fbcf647f2", "relationship--0177ee78-32bc-4ece-8b86-6fff305b899e", "infrastructure--da426486-6a36-47d1-9335-b787f5d3b31d", "relationship--49a4d0fd-9ca5-48fa-b8de-00907b619a31", "infrastructure--63c9a44e-921d-43b6-b489-77279a45f619", "infrastructure--a7520fd0-8238-47a8-bdc9-c3c4bbd65229", "relationship--f2dec1ce-a3ad-4215-a7c9-927e1664c68f", "infrastructure--3aa3826e-111e-447f-b47c-d68b9e82176a", "relationship--f742a4f5-548b-411c-9305-743b182e0f27", "vulnerability--bdbb0df2-8c45-4204-998c-24a9eb4e5757", "vulnerability--308f0a38-05c3-4893-bcab-e6bb9056cbb5", "vulnerability--00b841b1-a0bc-4dec-bc95-bbd0cffd3797", "indicator--8ee40e51-5906-45f1-acaa-1535a4e37a6f", "indicator--e1261778-9a23-448f-b0ee-28807740e9b8", "indicator--2d24ea3e-1354-4df2-9218-aa058dd63bcf", "indicator--ee048713-e742-484e-a34e-c084c828536e", "indicator--5664bdad-e95e-466d-a6b9-797eac6452a9", "indicator--a2390710-dbcd-470b-82f4-b67fa14a11f9", "indicator--193f4ad1-b0b2-446a-b391-2cb44dd5c1c9", "indicator--f382ab08-87fc-4b70-b90f-21f01483fe35", "indicator--21036317-7ff7-447a-97b2-79f99cebcc4f", "indicator--e0650c81-d7ee-4a73-905c-dc1aebc8c96a", "indicator--c33579ea-c461-45d0-8e91-bd601ea752ba", "indicator--b57f58c1-56fd-408d-92d4-56c8d437c7a6", "indicator--ec814fd2-b1b3-49f5-a124-b72047bf20ff", "indicator--e1031af0-3da2-4069-b801-a9214ebd850a", "indicator--ec23214c-539e-45a0-8d03-1348259904a4", "indicator--c049cfeb-c7d7-4356-83ba-43c90113bf54", "indicator--d40de5da-22b2-4344-a2aa-bed5025c993a", "indicator--5ad2d517-835c-4ff0-ab7a-c4909a1c5c66", "indicator--37a6355b-035b-4d27-8c39-e255643ed96d", "indicator--097958e8-91cd-4a54-b0fa-df9e06cb190a", "indicator--278883d2-308b-4845-927f-f8ec50345229", "indicator--528312aa-50fd-4ef6-9d0f-9de0c268442a", "indicator--672549c8-c2b0-4775-b322-85a78b20a4ea", "indicator--ba8a318a-2a54-4984-8dc1-cd4144732719", "indicator--46767c48-d7c6-4086-88e4-deb8ee530058", "indicator--a5628a5d-f7e9-43c4-818d-696a2a002206", "indicator--5d52040f-21ae-4189-a0a5-1ab6c8f76b70", "indicator--f25dd2b0-a8d8-40e9-b2f3-3aea4553f11e", "indicator--0acff69a-57c4-4371-aeb6-9af8949b04e6", "indicator--24f0f1a5-ffc7-4037-a154-4599a33f03ed", "indicator--b50144e6-e51b-43fb-8f22-0498397a52e0", "indicator--677b3940-aeda-4c30-ba7f-2f0c070991c5", "indicator--d1dc0c30-8ce9-46eb-9213-fd03e9ad1665", "indicator--75b11aa5-ed0a-469c-8c7d-bdd96cd61a73", "indicator--b8e1792c-e56b-4e30-8347-51fece593ab0", "indicator--0f05f670-2a41-431b-914f-91ba8822807c", "indicator--4b8f7956-d618-4262-928e-f7a5899f8246", "indicator--04dab19f-5648-4bde-bffa-d508237c09bb", "indicator--6a7559ce-c8ff-41b4-8bed-f317ab475385", "indicator--a720b153-e761-49de-9ce9-04b118e32094", "indicator--fcf7eaea-92e8-4c5b-942a-1fe70b69c3c6", "indicator--db365646-a426-4d67-888c-91f4ac1d3dc9", "indicator--1bb35cc9-9b4c-40bb-8401-5499480e1687", "indicator--d91f1f5d-9924-4381-baa7-83e3ebc89cda", "indicator--dd3ff821-ed4e-4ef1-9329-6b898bf204e5", "indicator--e5ad7c2d-d7d9-49e6-a910-8ec54812ad75", "indicator--9726814a-7f6d-48dc-affc-85b6aea240a6", "indicator--2a59d73e-b808-43cc-abff-67d9ffdc7287", "indicator--d796c7b6-a3ff-48bf-b5a4-e804dc254f9a", "indicator--0c337d1f-c024-4eff-94c5-4f166c9d8fae", "indicator--a6eb1358-96f9-483d-b797-a8fe8476971e", "indicator--de3ded42-db36-460e-8756-804406fcda73", "indicator--7195345f-b7c0-44bb-9fe6-232075a95f2d", "indicator--d457171b-ef08-4160-aeae-11aa77a0c9de", "indicator--e2265a20-07e8-4ba4-94ec-014a16bcfc1d", "indicator--0e48f9ea-9d92-4513-bf65-e9d66b52219f", "indicator--74168bee-79c4-4629-9ce0-3ad54937c07e", "indicator--45862e54-1cd1-43c0-b307-409f7d3db9e0", "indicator--29df5862-245a-4b7f-ba21-254743c7fc5a", "indicator--603864b3-9f25-4c56-9eb9-2bda0026e506", "indicator--2ca71785-07fb-486f-91cf-e3019d817eac", "indicator--35ebb346-81d6-48b9-b91b-445124be69cc", "indicator--1d2ceca2-2f1c-4cb7-afd9-046224386d99", "indicator--7d2ff2c9-c151-4bae-aba9-ac3c3b0c3c3e", "indicator--fd6dd728-e1eb-4ff5-8fab-39cd01d537f0", "indicator--59b08f60-81ce-407d-ac2d-3a240587b24a", "indicator--f6796760-0968-4494-bf26-e84a965b2001", "indicator--500ecc25-d6cb-4113-b4b5-8a03a3228d92", "indicator--3cdd3f18-872c-4c4d-b0e4-847aca92864c", "indicator--85d7077a-8464-4a1e-9ea8-becf396ebd89", "indicator--ef866073-c68e-4c82-bede-91d34013c693", "indicator--ad1ea469-4a83-408d-994a-88e5bee32d9c", "indicator--aa8d0de9-81a2-41a2-86a2-26a957ccc0d5", "indicator--e4d79be9-1544-4c3f-b332-8f9461e545d8", "indicator--b4d72b36-4a02-4fca-bcd1-1fe1d6afde73", "indicator--54f9e3be-678a-4707-bee5-b607476720f8", "indicator--01cb0519-be61-42cd-9671-7c206782ce89", "indicator--6d97bb7a-2a20-481f-912c-1293aae236cb", "indicator--a57dad7a-8643-496a-803a-c00045f0fed9", "indicator--712fb0cb-b3ce-478c-8d20-8a3b0c568aa1", "indicator--63adc6a9-06be-482a-bb16-5b5358132039", "indicator--48e78047-a664-4b03-a34c-a531e90f9125", "indicator--9427b744-5c11-4014-8986-5de4bce3ddde", "indicator--d6e5dc71-c6db-41fe-b241-14b3256f5884", "indicator--2dbaaab4-0e13-4b7b-af5e-57f181c90217", "indicator--7ccf1ed0-564a-4a4f-8a65-3d4a644610bc", "indicator--2b0b534e-c07d-4c7a-972a-1cf29759af18", "indicator--6570fc76-14dd-4c16-bc53-da77c6ebb0af", "indicator--22f3ed35-d004-4c03-a431-db941864c1ee", "indicator--18d991f4-6ebd-47b8-9f4f-82efd9ed1bdc", "indicator--e75ecf18-7bcc-48d6-b55c-f018c4761961", "indicator--238b2efa-5067-4583-9036-13e3ed1f318e", "indicator--ac90744c-692c-420c-a6a1-d91b56cc61fa", "indicator--4c49a58c-ee97-4776-9303-aaa84daecd3c", "indicator--db040c63-0d14-4b5c-b0be-e243674ba002", "indicator--f7f9b171-3bc8-4122-baa2-56abced5c378", "indicator--ebb1ddf3-3f04-4204-aa00-d9a32c01b951", "indicator--dc3f482c-cd93-4f73-adc5-0df782b393e8", "indicator--032e2c13-72d6-4690-a441-9b7a7f5d6860", "indicator--0c098317-bab7-46e4-a825-ace43b89d944", "indicator--a7df88d1-c305-42f8-818a-42a2728b170e", "indicator--3a7ce29f-dea5-4dfb-b553-3bf74e9cec41", "indicator--d1b74821-8e88-4c43-9c1d-a88e7b639026", "indicator--d262ec3f-33c9-442f-8139-97c4ad93d748", "indicator--ae5c380e-a580-4968-96f1-3a71fbd1d12c", "indicator--9b1cc9f6-b172-4169-8d60-361622851ceb", "indicator--114ddc48-8a9e-4604-8292-9d4c0eb09806", "indicator--d44e6921-16a9-49e7-be08-a6597c93dfec", "indicator--9e2cd45d-a3bc-4451-893d-dcedef76dcb4", "indicator--6eb9ab67-cd86-4d00-98b4-6d6a4b5b19c4", "indicator--a2e96d4b-250e-4e34-b0d8-016cedefc294", "indicator--95124f78-e3c1-4eb6-b22c-5f0b4a19b5b7", "indicator--ef81aaf6-abbe-495e-baba-081543ecdde0", "indicator--c1daff2c-244f-40da-940b-f172d22d85d7", "indicator--5565cb70-071e-4760-a43f-dca8a8f013ac", "indicator--6d622722-9dee-437a-af2d-e74dc27a21bb", "indicator--7a96799a-f90e-491b-b12d-fb74aeb8b19d", "indicator--d5113825-544b-4333-80d0-a53efcc04b8b", "indicator--d07d1b0a-74e2-49aa-b630-c1e5e036dd3f", "indicator--df757268-c07a-46fa-9fe8-b829c532131b", "indicator--2b2cd447-ba62-4ae0-9420-6fe72d90164f", "indicator--2709dcf8-cadc-4475-9cfa-eb3cbe015a59", "indicator--053bc98a-8f06-45b1-8ec5-cb90f624c06d", "indicator--ed585508-6fd6-438c-a230-28736fdda256", "indicator--c3752fee-43ee-46ef-8ac8-ccaebd351032", "indicator--a5fef665-9bf0-45e0-ba79-3b9805fff2d8", "indicator--502f0955-a40d-4fa1-8bc8-adbd7208ea41", "indicator--3b8ea982-4e4e-431f-8df8-c1c0c83ed065", "indicator--ea0ab64d-5091-4884-9608-d8005ec1d4d4", "indicator--079e621d-563a-49a9-9368-1d68674d47f9", "indicator--8ca4fe6a-7515-4855-975c-c7a7e456355e", "indicator--f90a058e-49b7-43e8-941a-413305f50157", "indicator--41e71e0f-ee5d-41c0-8802-447ca193ff18", "indicator--d060301b-e786-40d8-88d6-84bc19541c71", "indicator--4f873054-8580-486d-a83d-694100a9b6ae", "indicator--3625c709-9311-4e12-af01-c8a2f4aeff56", "indicator--8d349812-9b97-4495-b8ee-9f60a797a230", "indicator--68921cc8-13b1-4a12-bfdb-02b0a9ed4e72", "indicator--a8ba32dd-66fc-42ec-86d0-676aa9523625", "indicator--1b8cbac5-92d6-4d2d-8193-78a2c4f5b96b", "indicator--9c594bfb-0380-4324-aa71-ecf65210a9f4", "indicator--df08f148-21bf-48ed-8dab-18d3b792862a", "indicator--1d7c5fc7-00dc-4a72-8b57-cf5751bbfa29", "indicator--86d1760b-41ad-403c-8acd-a17d64b3f979", "indicator--d0dd2ca0-7555-4262-a15c-ed613613fbe9", "indicator--322b67bb-f41c-472e-9452-0b6a9643e749", "indicator--890bddc9-6980-42df-9357-4f75f13e4852", "indicator--53dc3ace-522e-4d59-94f2-4361850e697d", "indicator--cfa66f3f-582d-4e79-b21e-6fa5de57a151", "indicator--5831c389-cc63-4235-bdba-b0908984bbfd", "indicator--8199d353-ac3f-447f-870e-32c845deb509", "indicator--a7b4b5df-678c-40a8-9d98-3d16d753aa6a", "indicator--93d45633-d143-4d43-ba5a-4759a76360c0", "indicator--0742fa41-fe70-46d9-bd0f-365b6c30120c", "indicator--0d4b0555-8532-4550-b65a-57a3c3559ffb", "indicator--479581c2-4808-4b6f-9479-8963820a6816", "indicator--b65d9369-6af9-4921-a7d1-a7129455f356", "indicator--4dca5f67-9128-45ce-bedd-3aace0c9d4b2", "indicator--0e6fe064-e0e7-4b84-a3da-3d28f0a2c8f1", "indicator--0d139c82-4c0c-4355-89ef-3f579d1bf949", "indicator--8595a290-92d8-4c43-a344-f3f5700a2c10", "indicator--22989902-88e9-469e-bc4e-4d6248ad7a70", "indicator--20d7e9ee-1dd6-4f19-b06f-cb0b7e8a6817", "indicator--ea71c784-3f52-44b6-ba19-635e65f2942f", "indicator--5d59c854-8d30-40c6-8152-99e4a00e417d", "indicator--6f190ea5-a836-4c77-bf42-7f7fa02e3834", "indicator--2f188209-9547-43fe-b6ad-3421e77fabd6", "indicator--ccb5a84f-b084-4d43-884e-3e790cbeeb55", "indicator--e7590df9-d375-44d1-aba6-58bbb530faae", "indicator--21c7cdd0-51dc-48e3-9d4e-fa101ed76cd7", "indicator--59fa0e90-4088-42d8-9c56-34850731fd3b", "indicator--b047d9bf-0b49-4bf1-b375-9aa36f95d295", "indicator--f6168694-bbf4-4fe1-993d-d6af1fea42bb", "indicator--51bd09ed-5301-44a8-9970-46d246806121", "indicator--4d6c1535-6e92-440c-b45c-f55246a2a5ba", "indicator--23c4d1e1-7920-4606-bd30-228683de5975", "indicator--aeec6a97-3bad-40e1-a915-8c906c61576e", "indicator--f7017ed0-191b-4398-9dd8-4e658dec2adf", "indicator--6a47e766-861f-4e71-b9f8-15368ee2698e", "indicator--24d8e207-84d8-4c85-9a46-07df1a9295ac", "indicator--44484713-27db-4aca-8c9b-038fe8cc88ff", "indicator--ded44ce8-40e0-431e-904c-2833ea5ba819", "indicator--8bfb3afb-fd69-422d-9d31-e681b5aa4abb", "indicator--0d782133-e8d3-40ed-99ad-51570bd16ff7", "indicator--98c65ceb-c786-43fe-b404-af1a762fcefd", "indicator--ec313083-e237-4f28-98d6-0f3aab6fe6a1", "indicator--5d3b4002-7e60-48ff-aad4-53f3ccdf0848", "indicator--66024c97-7d71-49d0-adc9-92ef89ac38b6", "indicator--f0ff9a34-ed71-4428-b7cc-3aa780b03265", "indicator--1e5706a2-7e08-4cfc-9a5b-85a225533b39", "indicator--067218eb-758b-4f1d-b95f-b9e26676744b", "indicator--4d6aaa15-7c23-485a-885f-1ecbc1dbd991", "indicator--7dfd81c0-6a6d-4134-83aa-7f6dc2811023", "indicator--ff283ae0-9777-4843-96ee-af4b83ca7956", "indicator--9d17102b-4081-4139-966c-88ca6d030832", "indicator--4df247a0-a11f-468e-ad49-2cd5e2ed570b", "indicator--ccbeea64-1b7d-4735-aeba-f5a025d91972", "indicator--b0cd52a8-c951-498a-a387-1b21be53dfe7", "indicator--f8104b93-73db-4bd7-832c-8aa429815914", "indicator--48182d62-baa2-4715-a9ba-d6cadda36754", "indicator--553d820b-04fa-454e-9c8c-36e846dca080", "indicator--e878ff3b-34a8-447e-a2fc-0b453f798fc2", "indicator--af7a5c48-8b85-4396-afa2-c9efcbd0a284", "indicator--74d7d87e-69a6-40d4-93b4-69a5cb95306a", "indicator--d789aaa8-97c5-40b3-8d33-432dd2f9636f", "indicator--b11dd782-7b30-4a13-8621-521edbbbb8f4", "indicator--0a682285-4498-4933-819b-0ebe28a30b58", "indicator--b5430c73-48b4-4566-a667-0300a29fc2e6", "indicator--aaac5314-17c4-4d2f-8aea-b959ba6e3ca8", "indicator--03434a8e-f8ae-4e8a-8685-e327cd54b168", "indicator--a26f3917-e275-4838-a1b5-5b8a102359b8", "indicator--a1fe3289-c7c8-4d76-89f2-2eea3956a888", "indicator--89ed9e88-9d75-403e-9740-f8049abce8b1", "indicator--f2e58b63-32fb-4e13-b36f-af3ba9c37a68", "indicator--7253a2a0-8fa7-4433-934f-1d3f21f062d5", "indicator--97200a72-9030-47f7-86e1-58fe88272500", "indicator--54c5ff1d-153c-4e04-81c0-00d71910c91a", "indicator--8dea9dab-92b4-44e5-b927-d10d3ff6f2a0", "indicator--278d3407-169b-4c75-a887-e0ead15b1b40", "indicator--a754626c-4c75-4710-a1e5-f30f71652a5e", "indicator--01ed3d6e-4c20-44cd-82db-ed5ad0dbfadb", "indicator--5b981e32-b4e9-4dfb-adfd-e45fd63fb335", "indicator--146beb80-7246-414c-875a-6fd0772795ad", "indicator--ede04cc7-f1cd-4621-bbcc-06272fbf7b26", "indicator--7ace8c52-6ba2-447f-b845-69477bda86c6", "indicator--46be20d5-f457-43b7-9f79-74ba7e518c9d", "indicator--8b5514ce-c573-4a6d-95d0-68bf7a49f5c7", "indicator--d5da98a4-3189-4920-ad05-2d29a8a040d3", "indicator--715697cf-8b26-49aa-81d3-21d0a968d0b2", "indicator--eb1b201b-e768-4033-9f5c-c62a801d8865", "indicator--ad0b2f5c-c09e-413d-8537-bbb4ab69fafd", "indicator--8bb854ae-666c-4beb-b266-ed82db9d1187", "indicator--ef2fd1a4-2d52-4c0f-a26f-45a0825e5c0d", "indicator--55ebf57d-9da3-45cd-842c-055a22bee7fc", "indicator--fcc8a40d-a60b-4517-8b75-abb11ed16a9e", "indicator--92d1c2dc-2534-4343-a42e-03865695fb3c", "indicator--92da0d35-b9a9-48ea-bfd0-d8c95ad83b78", "indicator--fd7694ad-e298-48f4-bd4f-77602de602d1", "indicator--06937cd6-fe81-452f-8598-3366b5eef995", "indicator--48e16b6c-7b5f-4b3c-b70f-1f37a22249a9", "indicator--d7762bc9-c4e6-4089-98e4-516281482508", "indicator--1b6bdb3e-bf56-4372-848c-c34a9104c5cc", "indicator--48935b4e-dfa4-4c19-8187-806d0deecbf1", "indicator--bf9fad15-d0e3-4c9b-9033-9b9961b2f12b", "indicator--19c2a034-c2a6-4ff0-b8c1-837a22e966f8", "indicator--3086f27a-82a2-42a2-9c15-efc494ad8340", "indicator--473e2cba-ea32-4c92-af09-fb95fcf7e0a3", "indicator--311c76aa-180c-4e68-8660-60043e8220b0", "indicator--a3fd75d4-565a-4079-a017-48aa457cb86e", "indicator--25e72e8c-b7e3-4492-bde1-ef2bb80cef96", "indicator--e7b050ba-c7e1-4cf7-881a-99ae8721f96d", "indicator--ae6321d6-cc1b-44e3-873b-438353118868", "indicator--fcaaa577-e5d0-4ea6-bae2-89567ff578be", "indicator--710ae96e-eb6e-4396-a569-6d63deec4d54", "indicator--a7cd4f3d-e4ad-43e9-9488-698fab265883", "indicator--7afc82ad-815d-474c-9443-8c4923f749a6", "indicator--936b6dbd-32cb-40ca-b424-9ee449afaf5e", "indicator--60b1102e-2b64-4832-8f79-be81edcf67f5", "indicator--7560e3ea-3672-4c34-a34b-f49534186e60", "indicator--cd380e19-384d-4df9-8963-706a57ab3f54", "indicator--2c392b91-8ecb-4bde-beb4-a8daf3ca4a3c", "indicator--4e141310-d2c6-48ce-9143-89c4657fd952", "indicator--4a6c34aa-700d-4ebd-a85a-02fe1a171e7f", "indicator--8d1ef3dc-77f7-4c67-a94a-9445e093efe8", "indicator--812343ca-281f-461f-97b3-9c545fdf2415", "indicator--c1e727ad-7eab-47c5-9506-f82332f30983", "indicator--26f17626-ed17-4579-86d7-df3df14b8d61", "indicator--05f06472-213b-47ff-8974-53f4bd74d859", "indicator--e9ff5abf-4fb7-44eb-a11c-b774de48b1f5", "indicator--832ae06e-7680-4304-b1a5-4fd0114217bb", "indicator--c79003d8-e54d-4413-904c-2427e6026b07", "indicator--56fd831a-d6f6-43ae-8f5d-833ae41c0010", "indicator--94e70ad0-3efc-40ed-a5ee-14565e21a5d4", "indicator--de218b8a-e62f-4ad8-a503-4480019bf89d", "indicator--d6257ca9-469b-4062-ad84-9d3a88eb9360", "indicator--4fe84f29-bbbe-4157-89bb-16648637eb31", "indicator--3c76d557-fd90-4b04-823a-63b0d95d38fa", "indicator--1e5f8192-2434-4d55-99e7-e6de74b149d7", "indicator--5fc8ba54-ad49-4f0e-b263-9965476a64be", "indicator--c0e31fd6-726b-4892-b875-0006f556cb39", "indicator--23b5393b-d782-4704-bf14-f9171b49616f", "indicator--906b7d43-3d26-4218-baf9-aec6e760449a", "indicator--6f6bbd28-f512-40e2-a101-04f2c9701866", "indicator--d7878159-783d-4e00-acbb-496aca181156", "indicator--30bf861e-2c1a-4912-a1f9-20e11d55a7b7", "indicator--110d6da1-b3fd-470b-97d7-1f3f9fa78694", "indicator--9c8a774f-0b38-4889-9112-f85e789ebcbe", "indicator--c8462791-bdeb-4f5f-a640-26801a00ca7b", "indicator--65e52902-1011-4e01-9a77-e17a7d16ef6f", "indicator--d3d8d6d6-a031-41c6-b9f4-3f1ac2f8c043", "indicator--a2aa0d9f-5aeb-45c7-83b2-ed319c2ea4f3", "indicator--664559f8-67e6-4bfa-a175-dd9131f027ca", "indicator--00decc35-c55a-484b-8149-032787a09c1c", "indicator--c6106657-75e3-4c26-8230-620d238a0280", "indicator--750d9519-ab70-4a19-b3e5-92caabd4cd59", "indicator--92eed769-5d8d-46b6-b89d-0e10bf02d347", "indicator--92d516a8-777d-4ac4-a124-93ab27cfc497", "indicator--43a9acdb-02ff-4b28-bff0-149981f92ce3", "indicator--85d052d7-407d-4f4e-a8c0-54e858e2cbe6", "indicator--e07079ee-8566-43e4-b690-cc39dd1f4c65", "indicator--e0473c89-e964-41ed-baf1-c8981de4dcf9", "indicator--c2fdf7ee-5552-4971-9c02-8fc2745633da", "indicator--12752951-1033-4079-b3e1-37ee0ea9b98b", "indicator--02f8e4c8-2d04-40a3-a587-89609fe2b5b3", "indicator--e5175d6f-ba0b-4beb-bd32-6d203e9d5b02", "indicator--b98c78a3-e16b-45ab-812d-837f0bb7d2c9", "indicator--694e4f45-9678-4f99-8ae7-4b9f35174335", "indicator--5ebc64c4-bfa4-4f34-88a6-c81de4763831", "indicator--0ba203ff-d239-4d52-ae01-7a33a81b3807", "indicator--b77f8669-8b7e-4ca1-a39a-eb19747f9c15", "indicator--06efadbb-292a-4599-8a03-020562a06ab2", "indicator--a568e904-efcc-4c03-afdc-1403de9afd4c", "indicator--dad7f367-2ba3-4b50-b74b-53d8b8a49786", "indicator--7ed79638-6619-4e56-ade2-bb965a4bdab9", "indicator--0e72db35-c96c-4add-87f2-92b09bb248a3", "indicator--8959c0df-27ad-43c2-948c-a595920ac322", "indicator--8cfd3fc9-2028-4dfe-850e-89740f47fb12", "indicator--e81cf067-e363-45d6-a60b-43300369ecc2", "indicator--7d5dbf5d-43fb-47ef-9ce8-cbefd91020d3", "indicator--dd668ad8-1c41-4401-9554-39a30893d32e", "indicator--8a7e1a67-5816-4b6b-bd44-cf6c330ee8ff", "indicator--62834f19-11c9-4ade-bc41-a95d2385f466", "indicator--3dd6c04e-c52e-4256-ae10-9739393d7550", "indicator--78c02baf-17ba-4f36-9a67-01f2175e551d", "indicator--1f624824-3e40-4815-b78b-dc8fe6078706", "indicator--a667b0ec-27ea-4a87-90e1-ce1bb20d026b", "indicator--2058f03a-cc33-4769-a195-0d2962fc4165", "indicator--84f07a6c-e37d-4d55-8b25-e51e6b1cd3c4", "indicator--b2a663da-bac0-48dd-8bf4-92d7b63c73c5", "indicator--9ed57450-2bf4-4126-82cd-7b0aefd7924f", "indicator--9acc1952-2171-4f23-a2aa-711232f5a1be", "indicator--797e12e6-bf80-46e3-9f25-09719b10b07b", "indicator--89f549df-1621-40c5-a874-6b80ad23230a", "indicator--fba5cf37-0f8a-460e-b7e9-bd5e377a3001", "indicator--3a9cc54e-3f61-4531-8958-181290af0f03", "indicator--9b7754bd-0965-43b4-8bad-0c4dd76712fd", "indicator--042124c3-b663-4ada-9aaa-6c4c59c5ac5a", "indicator--fba2fd4d-4692-46be-a1d5-f2138dfc69e4", "indicator--ea451a07-99f8-4642-88e2-b0c2e4f37c72", "indicator--2a79dd90-e47f-411b-a114-ec823bb4d8d0", "indicator--e019fc47-4e66-4604-b268-4f8817268761", "indicator--c5aa4d71-94f0-4cc2-9eaa-777c51ec96a4", "indicator--9f2ad5c7-79e2-47da-a4dd-e36e45562c07", "indicator--74ca53d1-def8-4dc8-bb82-86b9ff757b2a", "indicator--42b1da00-4a2c-43d5-b5b1-86a653ac3106", "indicator--fd20021b-a77e-4085-8a6e-a178eb9ffa95", "indicator--d1bca352-2e47-4aeb-9081-58e28609ce2e", "indicator--0a548516-9393-4534-8eac-9e0cdcffb467", "indicator--6c8d2709-8c5c-4f65-98fe-197376b0438d", "indicator--83677e3a-7869-4a91-acc6-d4cb585ccc23", "indicator--a1160ab0-2ada-4d5e-a78d-551d56e042c3", "indicator--ceecbe68-e5b5-4493-9290-d29531c79091", "indicator--849642a4-f77a-452d-8c83-93341da5ccbc", "indicator--cc890e28-0ff4-4d03-a429-12f6f270e4bb", "indicator--c5f6b9ea-adeb-4318-8ee1-8bfd9cb7ed6a", "indicator--14da161a-8d9e-4e4b-a8c4-9a3afa5e1fbc", "indicator--2cb7cc33-3f0e-46f9-975b-e7903172dcee", "indicator--519c6804-26b2-4bd6-a0c6-cd69b26215a1", "indicator--1db31047-6aed-467d-8fec-abbe27e3f17b", "indicator--7523816c-a9d5-4988-9fa3-a1871b0c659b", "indicator--ab2b2089-1b9b-429a-bb40-b27743fb3b2c", "indicator--1ba1f4c1-a9e3-4999-b8e8-88b0d592e749", "indicator--8556f03d-5a3b-4e1f-919e-57f675380069", "indicator--df4c4800-5587-46e4-bc9a-59d79f4d78ba", "indicator--46a8c423-e84b-41b4-bf2f-cf92212c7ef7", "indicator--47e02817-e5ea-4582-b601-124cf7862b2b", "indicator--adc48c8a-6360-4977-a3c0-ec755eca9ab1", "indicator--edf3bbe4-7990-4fa6-b851-8f5dbd7be7aa", "indicator--5b27c30c-f2dd-4067-9688-3fb7af67464c", "indicator--fbeae480-fa39-4af0-8472-e0db9c8ed8af", "indicator--ae2fdc3b-43ba-4716-8591-7e7af0662e25", "indicator--8ae5efb1-1855-4049-bed6-05d0529576c8", "indicator--3786c033-1a4e-41ee-a72f-b3061d541ce7", "indicator--53435246-0255-4bde-868a-c26830d64d41", "indicator--f4609ee0-61d6-404d-959c-a03b1ae030ea", "indicator--11f2bd12-f468-4d32-9af9-75381ad05aee", "indicator--ed5e7f64-2a1e-4f2e-be21-353cc4d8d1e5", "indicator--99bc27a0-221a-4251-bebe-76d218a2ed7b", "indicator--0580b7f7-64bb-401c-9bde-648ee055b6c7", "indicator--e3701a52-8048-44ab-839d-720f54fcb9ba", "indicator--3cd7e551-f079-493c-89c6-48c00c6ceb5e", "indicator--a2a90251-597c-47a6-bd30-1f377ba28343", "indicator--97ff1a4c-c804-4d20-a2be-7cd720900869", "indicator--eaae5a47-e485-465a-a5c2-75492674fc8a", "indicator--1dd7e66e-0b71-4650-b2a9-f8af05b71e6a", "indicator--6c4ded1f-0b4c-4d0a-aeb2-249c0838d91b", "indicator--59694e43-de8e-49c2-a41b-2fb87a872e58", "indicator--d30cb80a-d524-4e14-8e93-5dae1bd560ac", "indicator--f283cdfe-543b-40d1-9c4e-aa1a8f8ab89d", "indicator--4f03e5ef-7e86-42af-8746-a17ba7dc02b8", "indicator--eba395a6-a1e5-4e78-8d5d-a35656ccbc66", "indicator--a09e1cd9-1bc6-41a3-8602-b0817ba91167", "indicator--fc60d2d6-39b5-4c7f-b260-51ba64168f0c", "indicator--dd6d9f51-7de5-4072-9d76-6e15554b4387", "indicator--bed3bb6d-6ff5-4a2a-9976-ff477b32ab7d", "indicator--0d2a99d7-8169-4c38-872a-37229d27e913", "indicator--38ecef7b-5bf0-40fb-a28e-5411e41fcc95", "indicator--f6e6e681-fc2f-4c90-9643-feb71a6afba9", "indicator--dfafd177-af9d-443d-a718-e51c47bf142e", "indicator--5231dea5-d8b7-4abc-be57-ee81d3ad78d6", "indicator--c28514ed-26a4-4104-94b7-e829df8cad04", "indicator--e3552823-b134-4786-8c5b-a66ab1e4035d", "indicator--b6f026f4-5e62-400d-a88d-225074a8f6ce", "indicator--05727bec-76bd-432c-967e-7cd255f38dd8", "indicator--d1a19c73-0f12-406b-b348-9e06ad21eb46", "indicator--f17ac003-ffc6-46b3-9275-7efc1ba7005d", "indicator--6b9a6e6d-691c-4d1f-97bf-a5a776e498d8", "indicator--6c451c81-e2aa-4e5c-ad74-e868b0a03069", "indicator--aab65341-1075-41f2-914c-857ac5628481", "indicator--b3025096-2676-4d55-9ddf-1fc30fe0e55d", "indicator--d6808676-4e2e-4ab6-a951-336ecf9ba2a2", "indicator--bc36e996-e6c9-4455-af20-32490dc544d8", "indicator--47fac9ed-20c8-4f01-8236-868ed79855a1", "indicator--53810b72-a152-44a2-ada8-15b0778b2d08", "indicator--f65f4ff6-c514-4515-9282-2dda0a5794b8", "indicator--82eedef7-9d33-453d-aca1-174b8887f215", "indicator--47ed009f-3918-4123-a841-c31ce1ead1dc", "indicator--18659e71-ad64-4afc-9e59-b4aa1c59b848", "indicator--14906077-a0ee-4936-a479-a25bd2a1003b", "indicator--ba8b4a60-771c-4fa6-afee-ea4ca829cfdf", "indicator--3c36e8af-dc09-4a72-acde-5d011c639d2f", "indicator--de63fe7e-0aa5-480e-abfb-0988ce79618f", "indicator--cf7426c5-db4f-4ce0-8eee-b3f15097a1b3", "indicator--e33643ad-a9aa-45a1-8463-9d1567c81528", "indicator--012d7dd0-d464-453f-a154-a99a4f18ad63", "indicator--c57a6a0f-e3ed-42af-8058-3f8be04ad96d", "indicator--9c6faf20-8482-49ca-9c89-253b1c0f87d5", "indicator--96cf1edf-9e4c-4567-a310-75d472f2aed0", "indicator--a95bf9f2-3a0f-4e88-9e70-d6a15deb0bb8", "indicator--e23f02d0-2e5c-41e0-94a3-70205e4fc699", "indicator--2e460473-2b47-49d2-a569-ebd8d6900f63", "indicator--dc0f3843-e46d-4e44-bd34-9f270c627b84", "indicator--8ba188e2-78ac-4722-b5b8-104d39ea25d5", "indicator--f7850034-e278-499b-9ab1-3e4fe8569251", "indicator--45997937-920d-4725-8b7f-a4610850d2af", "indicator--26cb6698-42b9-49ab-8e58-8d62650ab4b5", "indicator--3d3bf301-6ef8-4aa4-b1bb-44205331a09d", "indicator--a776ff06-b9d9-4d21-8bb6-e124e5d5a66f", "indicator--3c379eb5-5c43-4d96-8a46-ec9efdf0627c", "indicator--403dd97e-a659-4fc6-bc2f-4e2803633f3b", "indicator--601a863a-a957-4aaf-b4a7-cd028fbfa76b", "indicator--35e88452-22a5-487d-9ed4-797a8deb8dc7", "indicator--e7840007-070c-4a30-bc1a-2543b4efdcec", "indicator--e0e21ca4-fa8e-4739-bc6f-a298c1dccb47", "indicator--ec335ff3-062f-44a3-924f-c9c1728281ef", "indicator--8a1ecf26-10d5-46df-9663-b5dfd24f1212", "indicator--2989759a-5f6a-446c-82ca-7cc8febafc86", "indicator--4ae4e36f-8303-4cab-bedc-5033d07e4ec0", "indicator--12b89b3a-5837-42cc-b30f-89bd188bbd5e", "indicator--451c8440-9afd-45a1-ab79-16c5b0d3bb35", "indicator--f18dbe11-cafb-4877-aa1c-8051d45fd4c1", "indicator--e9cffdaa-e44b-4214-aaae-0920b7125b3c", "indicator--7c3b6d64-c2f1-40e4-8bc7-47eaa331813a", "indicator--8a2ed8a2-a727-4641-a2ce-9cd24e4e5117", "indicator--1d3437be-4c78-4793-b79a-39b0b76c7e6c", "indicator--14474af9-7136-494b-9c41-63565e0c7736", "indicator--e95b0e53-dc5a-45b4-b5c3-c7a2f9c68abf", "indicator--6028ed13-850d-470d-a039-d402af3a5a3f", "indicator--b7f2d8cd-9d54-4aa7-b180-ccccde4108a9", "indicator--df01a791-ebd3-4367-8174-0f2a93ab98f4", "indicator--36793193-9418-4801-915d-25bd1c10bc92", "indicator--e76771de-7542-4124-96c3-8800453e465d", "indicator--2b934540-7aec-4aff-8973-d96c540ff3fe", "indicator--058e53d0-4b1f-4e17-a033-842884453d4d", "indicator--853fc4eb-820b-4685-a18b-3ae72be68650", "indicator--a8e99fde-a8bf-4e73-adb3-f0182f3fb5da", "indicator--e4dfdf04-2d6b-4be6-a868-f907836af509", "indicator--dda9ae7b-5918-42c9-a7f1-b80bf11076a4", "indicator--ea5ca49e-52d2-4361-a8cf-2fe300e5620f", "indicator--1bd6d0f1-b1c9-40dd-9be9-dbb7c10ff07c", "indicator--d1515d28-65ae-4be4-86aa-19914f642ce0", "indicator--82716971-5863-4f77-971d-219c29a7528a", "indicator--38543485-2c99-411d-843c-ffe253372202", "indicator--94a16976-cea0-4b27-86fa-bf007c7ca462", "indicator--2160512c-40be-4655-aee7-db991a386ea7", "indicator--640e3e9b-0e64-4e7b-816e-448fd7115a6c", "indicator--532c8197-ada5-46b6-b961-aa1d1f65b6b0", "indicator--8e135661-2507-428b-a8d3-1d24ffc824c0", "indicator--5e9184ad-284e-41b1-bf96-4efd92f4c079", "indicator--23c2207b-f884-4596-a358-f804bff799e9", "indicator--e9868283-46f3-4bda-9f8e-2a98b6f1f9c5", "indicator--517f781e-5b02-438e-ab5f-137eaa8b8c08", "indicator--664f339b-37a8-415a-83f1-8f46b0d1ac29", "indicator--14d7e9fd-0d27-4851-bd04-bd8476e007d0", "indicator--0d329219-c132-4164-b4e9-e96c6a80d705", "indicator--309c113d-7344-4e3d-acc4-3f691399fc0d", "indicator--8b5cea69-0261-47c4-8311-f4fdb14e098c", "indicator--80729fcb-6cf9-4a51-8175-f26737a47dee", "indicator--8d66df98-facc-47d9-9ea8-852132a6b4fa", "indicator--73e191f4-bbd0-401e-bb90-5c8f2dab0ba8", "indicator--6d8976f9-56eb-4ba3-944e-99c0ff31a091", "indicator--1e8ba418-7b75-42c2-ae5e-68795d86663d", "indicator--d1b97b21-75d4-4b9b-980f-08182022086e", "indicator--6d5a9aa7-121c-4df3-a1aa-64d77b1748ab", "indicator--b4053fe1-9957-44da-bf4e-e4927e336d4c", "indicator--49a1008d-4ec0-478f-80c9-f4758eb6387f", "indicator--15f61f03-32d3-4f73-9395-a79dd37a7bcd", "indicator--5fd7b478-ee69-4038-8f5e-ae696be5d98a", "indicator--cb9bcf8d-86ee-48af-b650-a6518b4e3026", "indicator--9bf00c97-3ef5-4c58-9069-ac6b9d24c38c", "indicator--9a890999-8754-4cc1-bbe6-064b0d9d15aa", "indicator--fbd94284-6519-4fdd-9f0f-9ef6206aaff4", "indicator--910f4f2d-ab65-4c8b-ada8-02f8e80f7511", "indicator--929bfe94-7ae0-45e8-b11c-423994fa606b", "indicator--2df9d462-376b-4c34-98a4-39be6720e74b", "indicator--924a0afa-70d7-4867-b281-e82166c40343", "indicator--1f97fed8-3904-4ff9-bb6a-e80f8d6036a5", "indicator--4079bf8e-c5ca-44e4-850e-6b20cdfc2ab4", "indicator--2bb141a8-206c-4465-a661-f111946d5ff0", "indicator--9d60714b-92b7-46c9-a346-e8ae52e18576", "indicator--14fb5621-4abc-4ab8-b469-d9aaad92d67c", "indicator--0e9c3165-addb-429b-984c-8f151cde7e35", "indicator--ebce76eb-08cb-4bff-bede-8bcd954fc33c", "indicator--be20aa0f-f7ca-42f4-86b7-449c457464da", "indicator--8bf41adc-b8ee-41e1-bc27-f26effbfedaa", "indicator--b66c8449-85de-4d83-b584-381db42046c1", "indicator--f3f25d2a-7151-4c3c-8f40-0343d3b89827", "indicator--d2729135-d9b9-428d-abc0-65dac741b8bb", "indicator--de2fabd6-b5ec-4f6e-bba6-d940e049bb81", "indicator--075b0c36-3909-4a0e-b34e-94e072dec0d4", "indicator--782996e3-632a-434d-a4f1-c1e5260e6944", "indicator--3fa9cda3-a444-4ba4-b717-e0b7bb2f8da1", "indicator--06a5c657-fb66-4049-8478-728d326eda07", "indicator--c22f3d0f-9451-450a-bfda-0eb8bb7b4347", "indicator--18fc2fb3-34bc-4600-bf49-9f78fac11276", "indicator--164c7504-bbc7-487b-94bf-6db26a793277", "indicator--24f5631c-0c86-425a-862d-64d45072db06", "indicator--f77411bb-b08a-4964-8988-962615733f66", "indicator--9b2b24e9-54d7-47ad-acd1-c2a04a860f47", "indicator--33daf9c5-6775-4dd7-beb0-a2ed9d77b66b", "indicator--b1f5235f-a824-4fae-9ed7-f6b54341fc5a", "indicator--766ad268-1fb8-43b1-aecd-f8d098bb12da", "indicator--ca53b401-9a25-4917-97ce-34c385763513", "indicator--ad7ef9bf-0aaf-408c-b637-68ab092c6764", "indicator--db4e5fc2-6910-49b2-85eb-3dbf286e1b43", "indicator--f9028285-c316-41b2-86fa-1e55136fce76", "indicator--cfce25f7-ca07-47ea-8bca-993b2b2369e8", "indicator--1470d9b2-f39c-4f6e-aa06-00c547f0bb4a", "indicator--85587ba8-5cdb-4858-9e13-754407fb0057", "indicator--dea3e6ce-faa6-4b18-afa1-5d546e024fdd", "indicator--7ac72980-fa5c-47fc-8716-48936b4c3e73", "indicator--62d75e8c-0743-4476-be44-621d2c7722de", "indicator--a6e9831e-bd03-4f24-af91-017294c32643", "indicator--d80a9a3d-1c75-4ca2-9ed4-6070b181372f", "indicator--270ab32a-dc2d-4b3c-bfa0-af69188a6bc9", "indicator--c246926c-44bf-411d-9faf-fca14e40e08a", "indicator--97b10238-2975-413f-bb9f-0ec346b77a13", "indicator--96a8afd7-ee2d-4576-8bc9-b8d0dee84134", "indicator--b04154f3-1287-44bc-8e1a-351982afdb37", "indicator--5b417e98-2257-4c51-9cbd-d4dd435b5816", "indicator--24996955-f15d-447e-8c4b-34344124521f", "indicator--81b9585a-1a3a-48ea-bfd4-ed5ff8a64db6", "indicator--7c85162c-3215-4527-8b97-1c37aca4bf13", "indicator--05812d49-b01e-48fe-952a-20c6d746d8ba", "indicator--a6a2f8de-8081-412c-a218-5f18e73ba58e", "indicator--b5f50483-054a-4051-81aa-c0a4f8847ebf", "indicator--e0f17cb6-3b1a-40d2-a37d-3608dc83d6c7", "indicator--6903f0e0-b337-4a1b-bb30-29d1b8e59f85", "indicator--3124df13-6d06-4183-be98-d8d3c43bb0b0", "indicator--99a0b897-adda-44a7-bb5a-3fdadadbe751", "indicator--61cd7839-d46d-4967-9070-fadf6370b6bb", "indicator--9495a0f5-344b-4481-a2f2-42cf19f696ab", "indicator--d7d3b7d1-95ba-4c58-8449-2dc6c0cb800d", "indicator--9c444863-8022-418d-bcbf-0e38478a8458", "indicator--3e69781a-f6e8-449e-b352-1986d8bdef4a", "indicator--a76ddfb0-bdd1-4f4d-91ce-f7a62bce4322", "indicator--0008517f-e8b2-4560-9d59-d4d004a01a8e", "indicator--3029beab-a298-4087-9c4e-24c38e61cb17", "indicator--35e03637-3331-40d6-8bab-93ecf935d50d", "indicator--5da981a8-d1d9-47e1-8443-a5b62a880ba9", "indicator--3ffb7ab3-ef02-4c2e-96ff-cf7e45597819", "indicator--5391f54f-e2a2-4789-83d1-d3cdb13bbea7", "indicator--2d7232ae-6184-4223-8a22-99ba8d860391", "indicator--94a7b501-b86e-4a4a-90ad-ac888dabf64c", "indicator--514820e3-008c-429e-81a5-e62aabb82722", "indicator--470fb181-9934-461f-b6ea-72f3c5566c1a", "indicator--410d3762-3479-4c65-a682-6886eb047ca2", "indicator--c7faa44f-63a0-44ba-8e44-1eb85a82ce5a", "indicator--ad4f7b36-eda5-4fd0-b510-ab6d4e2aeec1", "indicator--d1474c08-1901-49b0-9ecd-bd88e468bbb2", "indicator--5f92fd3b-1b9f-4b97-a64a-f5189e1040c9", "indicator--412eefa5-f1c2-45c8-bb5e-31c1a57c181d", "indicator--d948d688-5038-40d2-b9ee-8f70d62a830b", "indicator--7af60fb7-fffe-475e-9bcb-68627bc86dd6", "indicator--1e8b6a74-7ec9-4686-8881-276a965cf6bb", "indicator--f6af899c-b106-40db-b0c8-6bdb5dc5a866", "indicator--6af26d69-3cbf-4cc7-987d-7906a1365bee", "indicator--fac6884f-5d47-4f78-b96f-b8e4817f4d01", "indicator--d6e551ff-76cf-43ee-81d7-7bd3f2c81aa4", "indicator--e23a990c-24c7-42fa-9632-d8b65a4b7662", "indicator--b3b1f2e0-6364-42d7-bff5-ef04c1ec27f1", "indicator--9bb0e82c-e02c-466b-a2ad-f76fb60133b7", "indicator--04647bac-a88e-4384-8ea4-2c54acea5eb6", "indicator--f85e0ddd-e24d-4974-b41c-1949f5892375", "indicator--a43c7156-f115-4fab-948c-94a079350c76", "indicator--ad2bf645-657e-492e-b21f-b61ec72adc06", "indicator--82b7e9ab-e5bc-400a-b2aa-6c635b64e8b3", "indicator--710459a8-f4ee-4535-8092-6e5b92c929b9", "indicator--42ed77e4-3b32-4568-a696-613cfe1e769d", "indicator--e89b8d63-3d6c-4a33-b73c-4c11258ee565", "indicator--5c6e8f43-f9f1-4267-8ca2-534d61bfa614", "indicator--723c9d80-436a-46b0-8bf4-c6ee1fc708be", "indicator--ba91c71d-58bd-4dce-9e8a-b8f4d2dc7847", "indicator--819dcf3c-614c-48d5-9722-9e1bb051ffc1", "indicator--625e9b00-ed55-4a5c-9c76-13677a842b7d", "indicator--7a8071ae-8752-43f3-85a8-4c429d0b2f24", "indicator--6b7515d8-791c-44af-a72b-3c940618900c", "indicator--d21178e4-a7e6-4bfd-9fd3-aa17fdd96253", "indicator--2bdb70b8-5be2-4f82-8ab0-1e44bf126ecc", "indicator--4ed6d70e-82be-41e5-8a41-06f6aca54ed1", "indicator--c64e235c-1642-446f-8780-6fa04f6bbd59", "indicator--68f8cff4-c084-4d08-a596-df004b1c7c07", "indicator--b41841c3-9885-4144-831e-3785d9221052", "indicator--bf3950c0-2aeb-4086-ab94-dd339ab24d06", "indicator--8c6a544d-56f1-418d-8da1-0c90af35b872", "indicator--ffa2823f-864d-41cb-97ed-13f60de7774d", "indicator--78af8b9d-6862-4826-8c60-d60912e0e95a", "indicator--07717946-e12c-4375-bf5e-658615b4fa5f", "indicator--5ec32dc0-9f88-4ffe-82b2-26497bd00927", "indicator--f8b3dd5d-9056-42b6-b833-b3fecef104ca", "indicator--aecc19f8-d618-467a-adbb-c20310dfffc8", "indicator--0b156453-0361-4d3b-81b0-df893311d032", "indicator--fc686875-ed08-42fc-a145-44107e776897", "indicator--4cbd3c60-56c4-4c16-86df-bdc08a1f5b73", "indicator--463080f1-f9cf-49fe-90f9-90001d38ebcd", "indicator--06b35f3d-715e-4b3b-86d3-1c61a4b40c7a", "indicator--b2464a62-1b98-4a9a-a74e-5e5dedd81147", "indicator--32e0d7b9-962a-47dc-8ca9-8b27055c8100", "indicator--12b3803c-8e6e-493c-86e1-d87247a5796a", "indicator--749343a7-ef5b-4c01-81ec-7dcbea8141f4", "indicator--4e65bff8-8c41-44c2-9f1a-9041301beb38", "indicator--e3a722b2-21dd-415c-9d43-176749f6a497", "indicator--779c82e0-3194-4b54-b0c8-d6f2397d6dd0", "indicator--abcbd846-d44e-41fa-af58-26b1d53ac2ac", "indicator--8865a40d-2766-4f3a-b9e3-7de4bd8672e0", "indicator--b04ee34c-43bb-45fd-a3d2-1cee304d7f9b", "indicator--b7f38595-b9c0-4b9b-ae77-9193a6475062", "indicator--1704e779-222d-4abd-8b8c-af32a06eab70", "indicator--9f8747aa-5d63-480b-b705-a9d4206d2a9d", "indicator--9ecb4054-fb47-46c7-ad19-b46ed4ef52b0", "indicator--19edaa79-30c4-40e1-bd24-d47619930ed4", "indicator--c561d417-6aec-48c2-a2be-3ac6cdf2cf45", "indicator--0b76bed4-de67-4bcd-be96-7229df0c44a4", "indicator--e2efa881-46b0-4328-b585-675b40389356", "indicator--eec60342-d10c-4cc1-a871-17a2a0368f3f", "indicator--49544427-2761-4b8d-9134-0718fdedf93c", "indicator--57f6f968-bb72-4f61-bd8b-34bddfc01b6f", "indicator--321a8c02-e649-4a1b-b7d2-60d271b6eef8", "indicator--ec278eab-9b2c-4f74-a2ee-09eedd92815a", "indicator--59981371-104c-45a1-b0a5-6ff978731b0a", "indicator--4d4ba1d9-9299-4193-b6de-d96b7c8c6fef", "indicator--5dd97082-1ee6-4086-9be9-a32a73debf18", "indicator--5f576868-e117-4019-8a56-11d4c103a5e9", "indicator--40835e23-eb90-48bd-9d35-850fbba181ea", "indicator--5c9641e3-8eee-4886-8ca4-3eb0822a0d9f", "indicator--6f7e7b20-fa60-4a6a-9ea5-73a77ad0f436", "indicator--521625ec-fbc0-474e-92ce-907974976c02", "indicator--019884fa-7569-4168-b25b-7a8a5a8718c2", "indicator--a9ad8b1d-0db8-403b-8e7f-7ff12bdb3fdd", "indicator--36ac1887-b51c-4cbc-b984-a20dd0234b42", "indicator--04f97cbf-c826-4f6b-b2ab-ad919628611d", "indicator--86c425c6-b4fa-4885-8dcf-ee6c7837cf52", "indicator--6598aef6-3cb8-4281-b0e6-b5c81b960c4a", "indicator--ad5c44dc-5fe3-4654-9743-349973c0efec", "indicator--5b45b811-15fa-4bbe-8d32-a8b44fed7acf", "indicator--acb088e9-b4f2-455c-b215-ff427bfe5fa7", "indicator--f07dd6c9-886d-4e18-9588-e8c1b7813576", "indicator--27a280be-d0ad-430a-a5a5-6ba9a98f7334", "indicator--ecd9252f-0d07-49e6-aeef-d282885fbd54", "indicator--fd5d6cbe-6774-4608-b9a2-42307247653f", "indicator--42970bd9-02d7-4d7d-8c1f-7597f2606be4", "indicator--4fc5c3b7-314d-49b2-bbab-52aba3dcdab7", "indicator--503f68fa-fc22-4344-a993-5627118a5a17", "indicator--dbc8792d-64ce-4ba5-8a11-bf19c9d69505", "indicator--ec72973a-fe29-4d6e-853a-8e509005bc66", "indicator--45c8a819-a177-4db8-acbe-63495346fa34", "indicator--84d707f0-344a-40fb-8116-19b6fa3834d8", "indicator--f30f9ca3-c0ab-4418-92ef-8bb05e7e0e95", "indicator--b565a3ef-f17e-4a67-ae45-a55735b7f069", "indicator--e446f2cc-edf4-4cab-9100-a80787434ea7", "indicator--34b1c849-5e6f-4dff-bfe4-7ec023dfaf50", "indicator--393f1bea-998a-4110-8fb5-4b2a8f078c69", "indicator--649aa5e7-0cc2-49bd-a388-020d689e2443", "indicator--d99f490b-c516-4bc8-be94-12cf11d32381", "indicator--ad45235d-664b-4fe9-84d7-ff5d6c7868a1", "indicator--af8b9bb5-679d-4961-89c0-b2e2b5dcebc9", "indicator--2e0addc2-2124-4d30-9e46-b12b32e32831", "indicator--548c48c4-d12a-4815-9d98-0f6461e5205f", "indicator--3d68cc52-65e4-4de3-a5af-45ba1f47767f", "indicator--3d26395a-4ab8-44fa-975e-ed3dd8bcb0f2", "indicator--a3bfbbcd-df42-4045-a3f9-e0881ea4ad4c", "indicator--7156dfaf-7ceb-411b-a635-44545b37f945", "indicator--cc3d2e81-c645-492c-9f20-6c64aff7a202", "indicator--658de206-377b-430c-a004-3cdc1a1ceb33", "indicator--f4ac276a-e020-478a-a06d-170306e69f59", "indicator--5e669061-21f4-4a23-ad3d-213bb1a9acef", "indicator--ca1c326f-d65a-4953-b798-0b6b4406f033", "indicator--90c2a48e-16b7-4015-8c49-2e26b546f3e3", "indicator--9d9d7247-bf8f-492c-a433-13c014ab2017", "indicator--b8691e6a-2c9d-42fb-97ac-fd4c65804b1d", "indicator--4beac2a4-2bbd-4ff4-86a4-5b43e52e0050", "indicator--b14dd018-f440-4649-9c5d-30e743422b38", "indicator--d432f13b-9ed1-49cc-8cd7-bdf76518f340", "indicator--8e9df4ec-71f7-4aa4-89c9-f04876d4d43e", "indicator--4322baea-ad13-4d63-826f-79e0e3333be1", "indicator--04de3c7c-7b81-40fb-bee0-d7d6a3760086", "indicator--85faa33f-5dfe-46ad-91e0-6f3800a93bbd", "indicator--59f314dd-3aed-47fc-a22d-46a9d9b1f37d", "indicator--2dfc3136-0e6e-438e-88d1-0b27543dc075", "indicator--3d724020-1ce6-4609-b152-3a660661fdf9", "indicator--86db9c10-c809-4534-8c2f-928ca3b8ee11", "indicator--1e3b6837-a344-4fb5-b07e-1256334ddf41", "indicator--35479cd4-52d8-4727-a3a8-b71e67b8d425", "indicator--4492bbed-450c-4feb-84b8-7ca99f993791", "indicator--a78c8ef8-79ac-43f9-b0b4-a1315d36c4ee", "indicator--2586e781-d09d-4b52-be74-41197e0a45fb", "indicator--7e23a4a5-5495-4969-98d0-408bd4d0ad17", "indicator--775c1e4f-41ff-4d38-a65d-8631fdbf03aa", "indicator--6cb7a261-b7a1-4d0c-a487-43e81c8dc765", "indicator--3ff141a3-889f-4300-ab85-42867a099f0b", "indicator--8421c6af-3dfb-46ed-a39e-8a60c04d9598", "indicator--5dfc25d5-f415-4657-b7ed-dc3a3896ca3a", "indicator--57c45d4d-ca5e-4a0a-96d2-bebc4f70daa8", "indicator--1b98da7c-12b2-4c32-a93a-df1a278e8f57", "indicator--2a8da619-dfd3-4ff0-826c-4999e5f85bd7", "indicator--2b7cc23b-a533-47c7-bce2-147da82e917a", "indicator--2301066f-75fc-43d4-8c72-3f97367c8b83", "indicator--95a2e9de-7585-4c26-a385-02a9e05e9e65", "indicator--79777d2d-f4e7-4db2-addd-4a73a3b8889b", "indicator--25e5ae26-c59f-470a-a5b5-f39b30d84ca1", "indicator--f4be2f2e-9bf8-4ae1-bcf3-3e3ba2a84a57", "indicator--7822d9ca-7f86-41cc-b403-32e4b33df29c", "indicator--69db0f42-3401-49ef-a0fc-85ce668c88aa", "indicator--929b7447-1c4d-458b-9926-0a9f1a40e931", "indicator--c93f17c1-5e78-4d58-818d-3e42dd9c8c58", "indicator--75767092-e23e-4968-8124-4ec97789c9b1", "indicator--0c2da1d2-aa6e-47bc-a027-56263f42d47c", "indicator--c2af883b-1106-404a-88fd-9563f108eef7", "indicator--c35b6625-3846-4c79-8cbb-4af9a2fa9590", "indicator--29d4f281-d64a-41a3-97d9-f60e3c2aa457", "indicator--589eaa21-05e2-4eb8-b326-76ec7b6ce6d9", "indicator--7f512a55-b45f-43a5-996e-62de01596d2a", "indicator--6bcef634-e6fd-4ad1-9f58-9d69eed96370", "indicator--8235eedf-895b-48b4-947d-f3452a7241c5", "indicator--aa556c4b-938a-461c-a7dc-db29c55dbd5c", "indicator--9ee8261a-3b8a-4591-bef7-337c633354bb", "indicator--e54b7cea-421e-4d90-90c1-99e75842833a", "indicator--e62882ec-bbdd-4388-87bc-d013b86bd727", "indicator--4d630f76-f083-40b8-a775-c8333d1dcaac", "indicator--2ca840eb-139f-42d6-b20c-d9ebadcc3c95", "indicator--e501ba3d-9426-4173-a42e-79251894bc8c", "indicator--87e9345a-ccd6-4579-8f12-de1f79884299", "indicator--b912a984-9ac4-4257-ba76-58bc351e95ef", "indicator--b527043a-41ca-42ce-be8a-ee0646efbdaf", "indicator--2fb1cbbe-ada8-493d-a042-7daa006fe51b", "indicator--29d8b4c3-4fef-43a6-af55-b279c29fdc76", "indicator--084bddcf-6fab-4c88-820c-48b92f5f1a8f", "indicator--afdbeca8-7577-464f-a770-a711f04a66a0", "indicator--e166ee88-f715-4b8f-9352-99783b01f073", "indicator--e1ccf872-d2f1-4e3c-bb17-5c0b3da89000", "indicator--ebe35768-3490-4a9f-827c-cda53a5b6d66", "indicator--27592e73-1bef-4216-9b8c-7724f7e87537", "indicator--85cde4a9-fedb-474a-93dc-33bdedee0f92", "indicator--e6946bd2-734d-412a-b638-32a1130427f4", "indicator--614d69ca-582c-42f7-8a0f-55aad0bce651", "indicator--0a2c0b16-3d4e-430a-b2ee-7604b0ef3fd1", "indicator--87395e56-9e0d-42c4-9f20-a2a701bb2a14", "indicator--1e46c046-7263-4674-b446-fac58f471365", "indicator--9a4a2335-5809-4080-95b6-ee2c67ae78da", "indicator--95434279-d5b5-41cd-9cef-e64c7af726f6", "indicator--c683637c-78a1-4816-a03e-59f2430b0e9a", "indicator--ef258e72-07fb-4792-a925-e5e87ec9be68", "indicator--eacb36d4-dee2-4e07-b567-cfbbabdee203", "indicator--4fee434b-6c56-43c3-9531-9de513d179d6", "indicator--4c41ee4b-c2d0-4df8-ad8e-7c31fb3e5f3a", "indicator--774ea8b0-28a7-4405-aa67-2543439e5015", "indicator--b6050741-df20-40cc-95c8-d5a17adffaf0", "indicator--635745ad-b589-4cfe-bf96-7f3058486cad", "indicator--d604a906-578b-43e6-9df2-e9b98f26710f", "indicator--d6cf0f65-afa3-4387-8f0d-8213f839000f", "indicator--4859964c-b900-4688-8771-d1fb1e09f940", "indicator--ada3d651-f6b0-4939-a507-93f01bb4789b", "indicator--820ae2b6-46aa-4a67-a645-dcee7434ae90", "indicator--b4c9beaf-e3b4-4a1a-b5de-2d2819c33caa", "indicator--83baed44-0b45-4dbb-b647-3552f12a89cf", "indicator--dfae7990-a5a3-4188-99dc-e82b9fb5ccce", "indicator--aab89919-e87a-4710-bc3f-aa318c3fd990", "indicator--88760db6-aeba-4958-9655-6d68da887b7f", "indicator--0ca337e9-4820-460e-88a1-6d0c26090820", "indicator--52086a87-30b3-457e-9d33-253f5b9dcf10", "indicator--23e6e2b3-71a6-4fb9-9613-3b6b1c266fa3", "indicator--1772269f-b205-48e2-ac91-71051fb11497", "indicator--f2c78012-a968-471f-8a0e-af950df1af95", "indicator--1707c4a5-e55d-44f9-ab90-5f4bbe238ae0", "indicator--bca466c9-1226-4f91-b158-b536b101a170", "indicator--87171159-ecbd-439b-9159-01bf55ff5009", "indicator--a9726d84-e59a-4887-bfd8-f1ed50623212", "indicator--3d3dddfe-0669-4771-8d54-aa725f824266", "indicator--24e836f1-b7cc-4425-86b0-4721120c49d1", "indicator--f8a7b01b-93c5-4128-ae62-35dd365c517c", "indicator--a58c9bf3-277a-4c98-bb09-27bdf51b3e17", "indicator--cd95b695-f3a9-47eb-a2ba-49265f96ce24", "indicator--82c1c906-2d42-4ec0-987a-17a1366cba80", "indicator--ee7632aa-0aea-409c-8603-01e8b24361a1", "indicator--963b91d7-4e7c-4150-a05a-01776539c8a0", "indicator--6c158a67-461f-41ab-a3df-9b785b5b9e40", "indicator--dbbc6385-84ec-490e-afc1-0141e28bca31", "indicator--e8246c98-39ef-4ec8-bbaa-d4e80db6bc90", "indicator--9a360aa2-5bf4-4577-93bc-9d3218238486", "indicator--c0b86c53-205a-49c3-a291-0961ab5a929a", "indicator--06d580f5-53fe-493a-9fb3-cd6ab73e06d1", "indicator--6a8b96eb-1a7b-4187-ab39-09ccaa998c99", "indicator--2b34a88b-4d47-42c7-a35c-7ca571ca0d51", "indicator--7ecc62ba-fc7a-4645-9dfb-323c3a72d189", "indicator--872459f3-4126-44a3-8a9c-a66fce48d381", "indicator--bb4e73c7-329d-4708-be3b-47163f761b01", "indicator--fdddcc90-0bb2-49d6-8bca-2290811cc019", "indicator--f074da32-9858-47ac-9cb5-6a1bbc515433", "indicator--bb39f82d-bd88-4bdf-b575-277e194d8134", "indicator--d860fcf3-7037-41ec-8ccc-f2b65c8d1f69", "indicator--6c8c0fd7-fa2f-414d-b0ff-e27d869b47d0", "indicator--7cadbb16-2e15-486d-b1d1-44ee1072f831", "indicator--a3a2c853-73de-41e8-a654-89992aba51cd", "indicator--b659ee31-7b5b-4d36-983c-342ddde68448", "indicator--ffed2da5-6fdb-49f3-ab0f-31ad751def2a", "indicator--22adc4aa-dfc0-495e-925c-ac740d888396", "indicator--c0fc5cb6-88ce-49ff-b83d-b6eb1b6e0d25", "indicator--eb33831d-0c09-4bf9-a679-de4f13ed07d4", "indicator--4bc46726-d8ab-4714-bbca-53e1235ec22b", "indicator--80bf1c30-c070-4bcd-8f7c-1d8b7e39087b", "indicator--77fb42fe-0ae4-4e20-ad83-0adff41fb808", "indicator--bb2383ba-e690-4be3-aa16-3b7aabe866b6", "indicator--90de35aa-0630-442e-9e04-9657498b5859", "indicator--675cd72b-a975-4694-bd01-e150d7e0c0fd", "indicator--57a64b1e-1340-4869-a554-cdde3136199d", "indicator--8f191e35-2379-4cd0-8a92-3480123b6e71", "indicator--2ea2328b-a20b-4261-8b76-769efb3d0814", "indicator--0082a7e9-0153-4a2d-b161-dce1f3eb85fe", "indicator--225480a8-0d61-45c9-89b0-dcffdeeb9b67", "indicator--6d70be00-f169-4575-9263-f18ca9764f3a", "indicator--ca795f60-d065-4336-88ea-7b2aa1b4f185", "indicator--6ef9402e-28dd-4450-aaea-57f66e00ede0", "indicator--87ad2c72-fa42-471e-866c-52f313cff258", "indicator--ebd111d9-f5eb-4d1a-a0c6-886e94c92ba5", "indicator--9812a8d6-9342-4e86-a14f-b76a3f336510", "indicator--9701cfab-ffd0-4a02-bfa8-bcb0fd691333", "indicator--147c7d5c-c9dc-4eb5-8fe0-34652794e51b", "indicator--e34fa316-45a4-486a-8c8e-f222b8b99657", "indicator--938bd0bd-9979-42f7-9497-00a6b325d992", "indicator--ccc095de-94d3-4999-8799-61858886522d", "indicator--3428d6d4-dfab-4aab-b374-e21613e48335", "indicator--a89d9d03-74ae-48d4-98a5-1ebbae6c6ea2", "indicator--e2ac6b38-802b-4426-b563-30427c03b28f", "indicator--2ccb1377-dd1c-4225-9f61-658e19e987d2", "indicator--0ba70e57-e102-4a99-9c49-e45c9d7eeaa1", "indicator--c3d759e2-93dd-4c59-99db-ebcbe58ac36e", "indicator--48da8a02-7cab-4e51-8aa0-e3e213d3c45f", "indicator--c8f28b72-ec92-40cf-8cd1-e720a3e989ed", "indicator--646ef146-eb94-4320-830a-9c8ee5636eb9", "indicator--5b0a4e12-e29b-48e6-9549-0fedf908d62b", "indicator--c60560ce-428b-49db-8c5f-9d5ce1190372", "indicator--598b0a46-da89-401a-8899-488f6e7be36e", "indicator--d5a50b3e-6bff-4e05-b175-79ae2d775720", "indicator--e66d52f2-f9f2-4a61-9f21-3b5bab670780", "indicator--cd8c1f69-86b6-4b86-b30d-39eba3f71452", "indicator--c82c9dd3-04a6-4a0b-a309-bc8531085cf8", "indicator--b669eacc-825c-4179-8179-9f4579218eb2", "indicator--449d5557-ace1-415e-ab64-7424752bcb56", "indicator--ec417707-82c2-453b-93ce-48cc442be74b", "indicator--137ecc85-b248-4123-a56a-c85872dab76b", "indicator--dec6c0d5-ae44-4104-bc58-3442f809ec4c", "indicator--cb069794-cf4a-4cbb-9ed5-d6080e9b9bc7", "indicator--5512c00b-32d6-477d-a430-51356363d525", "indicator--cfb8a1d2-2ab3-487b-99d7-6e4927278f13", "indicator--05d70252-46c4-4cc8-b26a-5e7bdc29768d", "indicator--44938098-e9ce-41e7-b7fd-710feedfb1f0", "indicator--2e1b2f32-db6a-47a2-9031-a01b211482e8", "indicator--667a6f6c-448d-4917-bd85-d524b2970fa7", "indicator--ee480c64-0bf0-4409-8eca-f4db7b3907e0", "indicator--30177fd3-25cd-438b-b2c7-4ce580ea1e6b", "indicator--1d6e8bda-8c98-452f-9207-858acd738387", "indicator--653d8ce8-049f-4a19-ab27-5772e48e334a", "indicator--6b7b1f1c-bea8-4259-a3bd-b948aa8c22e5", "indicator--0f2be817-04ad-4dfa-aad1-9f471b5b2c9a", "indicator--10f30546-4675-4d9a-9d26-0c5776f4ef9b", "indicator--102d72da-914d-4f02-b90f-3c3c3997078d", "indicator--b95eb76e-0773-4b4f-8e2e-afae2b45f7c3", "indicator--be6bf779-a6b5-4c8e-be2c-03455bd6aa46", "indicator--ff0e1944-aa4e-4d92-985b-890b27fe9b30", "indicator--cf600e74-9fb8-4871-af34-7c456931869a", "indicator--80512d55-e587-42cf-a49e-d75301cf6a5d", "indicator--963f93e9-119e-4909-b6dd-b7e7309673d3", "indicator--355a9a0b-5053-41b9-97be-916e54511bdf", "indicator--fcb45c2b-ed26-4a7e-9da4-25831a957e27", "indicator--263947d7-7321-49d8-9417-2f25a1fe4893", "indicator--b47c3927-c78a-4334-bb84-a5cf067ecea2", "indicator--21510c93-f741-4ec9-bbd9-6799761bbac2", "indicator--c53bd1d5-d310-4e4f-9625-432d4bdc3c9a", "indicator--cea2ee1a-fde0-43c0-8362-9cfeaae205a0", "indicator--861a3099-b81a-4874-8efd-24406cf22407", "indicator--010b4da7-3de3-41a0-bf45-2001d46f324e", "indicator--cb3399a4-d8e9-4fe8-9b03-2a47021e3631", "indicator--d87591b6-a0af-4d84-bd2c-aff1333fd943", "indicator--b953ac63-3043-4915-98a4-a0f59506f8f1", "indicator--20416d79-f56d-4776-abea-206ec822e8b6", "indicator--ecc59591-6f33-4076-8aef-6f570cec3955", "indicator--bd8b193e-315a-481b-8815-2a6c7870fc26", "indicator--d66468a0-fde1-4dd8-a316-5fc9eb246588", "indicator--d7289aa6-ac93-479a-8904-17222384b526", "indicator--b2ab6225-b608-48f3-80bf-bd5639e2b87a", "indicator--34a12ca8-1308-4bc7-8201-e3e77a36a482", "indicator--7b0c6d2a-fe0d-49c6-bee7-430c43b2ab19", "indicator--7bf7314b-eff2-46ef-9098-e2aa480610c5", "indicator--2efec8b9-ced9-4a1d-8ca2-94e3e9393438", "indicator--30489283-81d7-4687-9b74-742cebc61ff5", "indicator--54f4f22a-d865-4ef1-a256-fd747c1630b6", "indicator--97968d81-1431-4113-95ec-f7d246559a89", "indicator--a9c5a5e8-3e78-4227-a67a-45f8989eb4fb", "indicator--9b3fa43e-9d8a-4d63-8ac4-ea4fe049860e", "indicator--a182a89a-4dd1-4cee-b799-a801ee21a8e5", "indicator--865562bd-0dd7-489c-a94a-1ccbef99a98f", "indicator--bf81e0b9-9e64-4c25-82ef-eb03e56a5f72", "indicator--db2a4731-e81b-4283-b12f-89d0a6e46725", "indicator--b1e1f970-d72c-41b4-b5ad-0651209a34e3", "indicator--d0fe73f7-4274-4fb5-b8f4-dd1f9d1db356", "indicator--d2351284-424e-4531-8ae8-dc916d70effa", "indicator--3510dd33-6ccf-4621-8a01-eeb52c6de800", "indicator--64484ac5-1272-4d78-8122-0296b882f8e9", "indicator--e4360142-f561-469d-b192-bc1a8534bda1", "indicator--62f2a429-4338-412f-a6bc-8196e3222481", "indicator--5c56f6cc-3fc1-4409-9e17-f4ddcb425fb7", "indicator--088567f9-2fd3-48ae-a042-51385244fbea", "indicator--7045c6ea-69dc-4253-98b5-d6ded2508ebe", "indicator--b1570880-25e4-44ad-a3d6-763bc314eb2e", "indicator--217f0cbb-af15-4da6-92de-2efdd39fbdb5", "indicator--81859e8e-b1e5-448e-96db-32e85499b0be", "indicator--0158af09-4daa-4474-aff5-26d91dcfc4ad", "indicator--1b2d2d81-429a-427c-b20d-c28eae655b4b", "indicator--d8602206-ba7b-4cb7-8478-31e963784a71", "indicator--5c1ad494-e68c-43b4-9675-56b4a7b6731b", "indicator--722380d2-41e7-4818-9fda-b6409597c557", "indicator--d2e586ac-bd95-4e36-b38e-26355e296ec0", "indicator--1aa8a087-bfbe-4d07-bda2-5c6dad885521", "indicator--ca468f21-1e65-4af5-b78b-8ec52ced6d9d", "indicator--98658c12-4507-43c3-9cf1-676ed5330998", "indicator--bccc50f2-0e9b-4a4a-8672-ff5b2e87903b", "indicator--2535907a-5265-47e9-985c-76d2d054d16f", "indicator--705483c1-0651-4046-801c-3b6d44638c76", "indicator--df82397e-6ab4-49b5-b770-d4c540504964", "indicator--cf519184-8589-4aa7-bf65-4b2dea361f38", "indicator--61513a74-9dbc-4d41-9c31-c4f26bde90bb", "indicator--b3610e5c-e528-40fb-87b1-b3e954bd7d8e", "indicator--a67e1890-564e-4b59-835a-4eeff3e18129", "indicator--3a5acd1f-16fe-4eaf-a110-721186efa42c", "indicator--f8100d24-fdd2-4395-9a7e-834127b7512a", "indicator--36a7f797-916b-447f-90ed-7cc53eb3fbea", "indicator--a2fcb746-ebbf-4129-96ee-ce4e71ef2cca", "indicator--3137e519-d4b2-48a7-9c8f-49992ac1921d", "indicator--071d5582-3c55-4bfd-8fa7-020ca42383f6", "indicator--9d64fbc2-f75f-46d1-83e9-71bde2bdd962", "indicator--489a6dc2-f694-4f8a-9b0b-12ba163c9719", "indicator--c4feff76-3460-40fd-b7aa-b2e6bc00f5d4", "indicator--def73609-42f4-4f33-9764-af9eb380b8e9", "indicator--a60aec5c-8168-42d1-bd75-8fb42ffb1bdd", "indicator--4f8ce51f-f3b1-4d75-bbfa-05e7587e9172", "indicator--ad44bbc0-6fae-4cb0-a02c-e90d322586f1", "indicator--b39be8bc-aa38-4056-a5bd-76b3dc451cf9", "indicator--f0f96548-6239-4eaf-88f7-a5ce22f05754", "indicator--cb53e0a9-00a9-45e3-8f85-e65a8b954e2e", "indicator--89b96be8-8ed9-4e9e-92bf-d67005f923ed", "indicator--22977677-ed2f-44ba-a5cf-8a2ea5d16045", "indicator--f5a30787-15e0-4119-89a4-269098768e85", "indicator--3a7535ad-14d8-4a8a-a75f-0676b35e8a62", "indicator--bdde7037-d770-450c-8646-c13a94de09f7", "indicator--1cf66b36-9896-4f71-83d3-e6f2fb461afd", "indicator--9a2bc2b5-5b83-417f-a8a4-f611064d35c3", "indicator--176c26d3-e9ae-4390-986a-f1f5ee2d699f", "indicator--726c5add-aa8d-4b0e-9cb0-969b6d4ad5b4", "indicator--92a6df27-ad39-4cc7-9c85-e0691454bb59", "indicator--b7e2ad0d-dd0c-4f33-988f-13fb8cda3c1a", "indicator--561f97f7-34a9-47ae-aa29-4ab07990ab92", "indicator--1d8581dc-8fa8-4e4b-849b-214fbc7c1674", "indicator--817fffc8-5606-46b9-9823-514dc732bd67", "indicator--434e8082-73ab-472f-b935-6599c8a78a56", "indicator--3baf8bce-baf6-4f76-a9d3-e8c1c9a1a5e2", "indicator--1f7c6c3d-00c7-432b-876e-916013401376", "indicator--efc74991-46d5-4038-9ac5-a358576327d7", "indicator--7bff7b1d-4226-40d2-9e9e-e584c51a3976", "indicator--2bc956c2-a6aa-4675-a396-328dca4cd09a", "indicator--dd32c006-a4d5-492c-8197-3d944dd5d57a", "indicator--d39b426b-c44d-409a-aa62-b0fc4306389e", "indicator--8e182384-4ce5-48f6-9efa-f8a75a283a61", "indicator--00dee9f5-31c1-48aa-9c95-4445ad9d90c2", "indicator--5273a7bb-aba9-4b15-8f83-c35408e6c554", "indicator--81de90bc-dd0d-48f3-9ccf-9ca421b2a1b8", "indicator--550c8166-1c91-4b6c-8e11-fd9fda2c5692", "indicator--a451d2d3-9dbc-4ede-acd8-b77ee8c1c9d3", "indicator--9f428b64-f8ee-4429-9d5c-da73e33db777", "indicator--a29dd5b1-d833-45d6-9a33-81ac4bc7af82", "indicator--dd94008c-dea3-45c4-9c72-850f5d0c0a8c", "indicator--6383d957-f466-4442-b0f9-554128ca2b9e", "indicator--4612e760-be32-4e5d-8eab-7bae4c95e8df", "indicator--92ec260c-8504-45c6-b733-c0666bfc504f", "indicator--4ecfd8a6-dc19-4a4a-b361-0e7feab67aca", "indicator--923cd9d7-4001-44f8-bcd5-1d0f0c63ecbe", "indicator--ca867764-9268-4815-be48-5e1365f9156b", "indicator--b7925fec-8d00-4b4d-95ca-11d4d4da2e63", "indicator--ae029c23-979d-437d-a289-55d8513f237f", "indicator--ead6d0d7-e1ca-4f72-9cd2-639f110128ba", "indicator--ff388557-7d5b-4375-a68f-63a96e3fe7aa", "indicator--f42d7447-44c0-4d29-8caf-4b8678137331", "indicator--455960e2-0461-45f4-90cb-f2318db27779", "indicator--4fc49f41-d998-4174-9633-dc66b7ef76b4", "indicator--bde50a68-8132-4589-9e1c-2333b69317ea", "indicator--d20a8296-c902-478d-b0a6-22007f8d1cfe", "indicator--abf516cb-2157-4f1b-b739-5739eb3f239e", "indicator--e74b5665-dcc3-4165-a001-6b53fd3d5a98", "indicator--12964e81-67be-44f6-8853-27397fad04e5", "indicator--af2c70c4-48b2-4c05-9566-303a896a8075", "indicator--48bb9289-3d98-4d53-8e0d-83dce5ddde03", "indicator--ef7e2639-2219-4817-bbba-8d8c98a80e7e", "indicator--9eeff4cc-68be-41a2-b674-37713e2508d1", "indicator--26576091-6a8d-4000-8fe2-0964887a7bf5", "indicator--f90f8dd8-0051-4eb4-a1cd-893a1b782c04", "indicator--b183c93b-b3fa-4c0f-94c7-ed0535fab5f9", "indicator--53c99ee5-2e45-4bb5-bfad-a04f367238f8", "indicator--c7b118a0-358c-4e9f-bbd3-3938cd9c78e4", "indicator--19e7e410-cd82-4187-89fb-a735a153a771", "indicator--aa8a0b73-1c0a-47c9-9b28-87a31b763362", "indicator--6a14b813-26eb-4df0-8b10-9e8a7150a1f7", "indicator--eabc4a46-1590-459a-b1cd-d1eb122b92f5", "indicator--71edea2a-6ece-40ff-9dae-d3bbccf526bc", "indicator--8f898f25-5edb-4003-8b4f-05cec36ceda6", "indicator--b6a43dfb-556c-43c2-8ad9-40eb4b90fe1a", "indicator--cca5ab1f-e826-4ef8-a731-fe0fb5c962ed", "indicator--4dc17b5f-4000-46a7-b56c-e19a2f5aa634", "indicator--fee9af82-320f-4915-a27e-4af43d02da7e", "indicator--279fd634-b259-403c-8ce9-b4472f09fe96", "indicator--2fb2474d-3091-48de-a7fb-51afa21644bc", "indicator--8abf55aa-b473-41ee-83c4-a022b1cf4aff", "indicator--27228b9f-7d15-4595-a12b-6fe52194d634", "indicator--be4fa1d5-c26e-415f-9fcb-51533982ae2b", "indicator--b6db4d7f-a4bf-4184-a5f6-bb5a6c42ae64", "indicator--9edf51ca-4155-4591-8972-794ca6d62243", "indicator--ddbe0ac9-eed7-4fc3-94c0-465620266f47", "indicator--42435954-eabb-4a5a-a02d-38ec8bd2bfd8", "indicator--cfc16635-ccb3-46be-ba53-5b57a9ca0513", "indicator--9b3e16e2-86cf-4d6f-bb32-2b1d941b5e5e", "indicator--acbae8d5-6ad7-4024-9a0f-c0374324174d", "indicator--ac844ddf-1baf-424c-9384-3ddfbb63ca71", "indicator--8fb5d49b-0f44-4fc3-bab9-15243a504a19", "indicator--ecc220a1-cfab-4ea9-8563-105d667fd8cd", "indicator--4210d72e-496b-4d0d-a312-5348626d0c7d", "indicator--ebcc3e44-4cf9-4ec2-be24-29e49f76269f", "indicator--3c521c00-3060-4847-b1ef-05111708ceef", "indicator--56ca1747-6ed7-47a3-b816-79df59352045", "indicator--c8ef504b-68a8-4f01-96e9-f84add18fbdc", "indicator--dc98a896-f123-40c9-abc5-f649ed52107a", "indicator--1fbb7d8a-94aa-45a3-a9a3-c9760b88e005", "indicator--f3a531ac-bf8b-4d95-960b-94a7e3e465bb", "indicator--6ff4a11c-91d6-44e2-9f76-5d5327adf856", "indicator--096911f1-0af2-492e-8d8d-1e034ccb680a", "indicator--caf69d0d-17c8-498b-9ed6-f95f870bd16e", "indicator--53aa2deb-805d-45c3-812e-3e160b3334d9", "indicator--30cd713e-1e56-437e-9b68-12cb6f16ac5c", "indicator--f860ff1c-8c7d-47e1-8c8a-00f98e95a85f", "indicator--0c66cf41-4a33-4de6-84b6-e4ab86f8b7f3", "indicator--dc8ea5ac-d614-4086-8448-6def0f04c690", "indicator--9af2049b-baec-43e4-9a87-6b8575708bd1", "indicator--6d201f91-6eaa-4567-8071-c5d2250635ab", "indicator--2762f83f-aedf-49c4-9db6-80bb98b0b5f5", "indicator--ef21dfdb-10f6-4d06-aec8-a71490eed430", "indicator--ca38aefa-713c-4922-aced-e5ff367bfbfb", "indicator--a9f206f2-9b98-4ae0-9a05-05fc5b7c763a", "indicator--bd3013b5-cf60-42a3-a42a-aab780485e88", "indicator--ea0afed3-bce9-45e2-ab7c-fabaf3fc5377", "indicator--f5c7686b-2a67-42c1-9af4-f67b94c1d7c2", "indicator--8e59cf9e-abd1-4ada-acac-f398c883713b", "indicator--521716a6-0d4e-43a6-8d83-d82b5d08ec50", "indicator--aed9ee32-1b12-4221-a3fe-ffe1004edbbd", "indicator--12b8ec38-54c1-4d32-900e-908ca49ad5fd", "indicator--a67c38f2-db7f-46c7-9a59-93f0bf7f1bcb", "indicator--fdb298f4-2515-48a1-878e-ebaf31955057", "indicator--f8c61b54-549c-46c3-8d3f-94c904f0d864", "indicator--a53b63d2-edbd-4b57-8f29-833994238945", "indicator--9ac15293-cf2f-4739-8bf7-e9893a0969b8", "indicator--121fb68d-33ca-4862-8bdb-538bbb38dd9d", "indicator--70f723cb-1fac-431c-ab4f-913129aa1644", "indicator--da968464-5a1c-47c0-aa1a-ed4dc6493f02", "indicator--34d3c563-bc8e-4798-92fe-a237ba1c5278", "indicator--73d8d301-77da-4384-b6ca-47a21a68565e", "indicator--d86dc474-43bf-467f-a218-c038e5731b90", "indicator--7331cb52-aca7-4f72-88fc-aa414fdd1f2a", "indicator--5e68bea7-2c53-4dfc-9305-507533ee9ce2", "indicator--d5aa6909-f1a0-4f1f-8c49-df73d523f353", "indicator--e7bdf232-002e-4aa0-b2c3-409e26bd5098", "indicator--f5f83849-8f3c-4ffc-bd53-2de43449a6e2", "indicator--82115191-6d6c-4e69-9010-84511e5e8720", "indicator--2591ee71-7916-45e3-8eba-f6f397f674f1", "indicator--443414a4-4219-4372-911c-ce35a1af548f", "indicator--07e15776-d3a0-4e0c-8f61-464e5a7e1611", "indicator--eda847a3-dbad-45d4-b716-cd1fb8f23983", "indicator--891a5d3a-3adf-452d-bb1a-0e17fe379089", "indicator--0792d998-d51e-4371-ad77-b51ab6c31fe3", "indicator--618f8cf5-d5e0-4a62-a62e-45f07da42c3f", "indicator--5b01c417-75b3-460b-992b-abd80f500bd3", "indicator--10c79d13-2c92-4915-a6eb-432451683959", "indicator--fb306458-7c6f-4d8a-8934-db2de8b8bed0", "indicator--9b23d1c1-26ad-4c0e-a870-04407074fa4c", "indicator--5fae57a9-7eba-4ac2-9bab-d2fc2fed3afb", "indicator--a4c081b6-535b-4c54-9bb4-d6d719db234d", "indicator--80361176-bf38-4115-abfd-ebd77dc1e0bf", "indicator--d5b579f5-00ef-4588-9f6a-6ff7d302727a", "indicator--c26efdcf-9223-42e0-90af-943bdd24dc9c", "indicator--1e6353f5-3f99-4ef2-9cd8-6f2295684c21", "indicator--e38f7265-306f-42e2-a6fc-ceed1fca4d90", "indicator--d13f2af7-e690-419e-92d5-09e2321df0c2", "indicator--0c31b136-0893-49b7-9009-37ed9277ed7e", "indicator--2c75d01d-8c33-441f-93ed-1e7d5cc16997", "indicator--1b68e524-c3f5-4385-8df5-eac953978dee", "indicator--c91edf2c-3b91-410c-8bd5-e04eed229dfd", "indicator--e00b2e05-dce9-4aff-82d7-8c914f8675f9", "indicator--f3d3c5c3-1209-4d94-8421-a77f81a580d2", "indicator--d772cd61-1cd2-41cb-8e85-d2de83c25b74", "indicator--62c7e648-dbd6-4ebd-8ec0-5480ccf45557", "indicator--83e10c87-0275-42ad-8d49-196a992c58b3", "indicator--fd44d6d1-fdfb-4cb8-8c86-6a54dd95a65b", "indicator--bc01be4e-a4b3-4946-b0cd-aa63aa0491a4", "indicator--23e3bfdb-017d-499e-af43-926f6bb863c3", "indicator--07268166-7f8b-4549-930a-5be7015fd342", "indicator--23758db2-668f-4368-bc2d-2360be182477", "indicator--4d755c30-4852-4368-8cbf-3b11fadab651", "indicator--5470adc6-c489-4758-b7b3-ba0c05c92782", "indicator--c4f8a4e0-0c4e-4840-864f-08a3638dc371", "indicator--ef232348-2ce2-4e25-8a99-a4cde3b29130", "indicator--e51ba45a-63e7-4d3f-83c3-24c1aaa608cc", "indicator--5f8bce97-8045-4088-bc87-3d962601d6fa", "indicator--e620f663-6869-414c-89be-b025400fca5d", "indicator--64616f3c-45c3-4be7-ac9b-2363dfee97c3", "indicator--922257fd-164c-4e9f-abb0-1ba3d1b34f03", "indicator--de4188e9-6145-439c-b3b8-589582d7a374", "indicator--709b67d2-8979-444a-ad91-1da572088bdc", "indicator--4047add7-cdc0-4ed8-910a-1b0bee03ae2e", "indicator--a9ddd489-b110-4599-be4e-e2cf83b8224b", "indicator--35b7c652-fef2-42d6-8ffd-5b55c46411f4", "indicator--96365a04-6f73-4f5f-b312-a3e6e6140af0", "indicator--42c4f03a-ed04-4ea3-986f-808d0a53f2e7", "indicator--d4034665-08fa-49fc-9311-3b064bb6417f", "indicator--972ee51a-5ca1-434a-b603-aa4d48b4f4e8", "indicator--3532e09e-ffae-46cc-a52a-2f952079fdfa", "indicator--7ed099a1-9993-4bd5-a47a-681684e4073c", "indicator--57eea8c0-401e-48ca-a555-1184997c9ee6", "indicator--b0060875-e154-4b98-9d0b-1cff1664e906", "indicator--d61081ef-d614-4fd6-8688-988884018150", "indicator--acd21ce1-36d0-4cc9-90fd-704fd28d6abc", "indicator--3faf9895-e02b-4cfd-853e-26c88d695436", "indicator--be4e3b58-5033-4b7b-989a-55deca5ba2ff", "indicator--e4e59f4b-d5d1-42ea-85ec-5dca840514d1", "indicator--16f0cf29-9ec0-4754-a11b-44dedf8a4dc6", "indicator--3c673417-afb3-4a59-a7ee-4eb09a2e0f05", "indicator--d5d4535a-7ebf-4423-9bf3-9e74804a81e6", "indicator--e3df0fb9-70e3-4a93-9311-4208661d68d9", "indicator--6e3f8bb4-ddfe-4134-a29f-b9ab807e6d74", "indicator--5175de01-15dd-4aa8-9244-3e726a1e82be", "indicator--6b2e2666-724c-4562-bd6d-9ac60b39099f", "indicator--9035f023-da9e-42eb-b9a6-dbec1d7e47d1", "indicator--ea0e9370-f65f-4661-aae5-27e1e587b61d", "indicator--a288d5bd-6190-4c98-8482-4cfd811777e4", "indicator--749becf5-5378-4cf3-9523-f67145800726", "indicator--4f78693d-aff5-4f1a-9142-a4d8d9d2eab4", "indicator--2f0ecb9a-da98-475b-b01f-44bd1deb29ea", "indicator--a27a043a-125f-4979-a9b1-5c8dc25ae2be", "indicator--b474b7f3-d012-4c9d-b487-15ece57d6188", "indicator--fcdbba45-5f96-4b59-8999-4c762d8c1506", "indicator--ed540b1f-3700-4a83-8fb0-66774e6e417a", "indicator--fdd49aab-eed7-4832-8ade-e843e0dd6adc", "indicator--d8da3673-7319-4279-9605-fd8e8e3d0451", "indicator--ee5607b8-8b74-43b8-bd03-ca1c5008e3ad", "indicator--b5e9f636-9a92-40b6-8a36-fcd410046c1c", "indicator--db98d2a1-2acb-43b4-b766-dd95afdcf0f2", "indicator--77793272-abd4-4522-a5c5-2ee24212ffe8", "indicator--97dc7099-506d-4305-889c-dfd7c6549666", "indicator--57513d19-4152-4bba-b9be-94c5cd818347", "indicator--c1b9dc40-7f92-4b0b-864e-8733569af2a6", "indicator--5ba4d6b4-a518-452f-a2b7-155bedab22af", "indicator--bd51c146-9f8d-4ae9-8854-69b4b9bb2f47", "indicator--706a805e-0af2-4c76-98a5-4e9f3a4835a4", "indicator--c265f37a-4f38-482d-a8aa-3be9ace6d418", "indicator--3bfe7e28-b1f9-4e2d-b502-37c03bfb6eed", "indicator--016abedc-1ec4-451b-893e-4569651e6a1b", "indicator--cd10ad00-6999-4f4d-a97c-6e3c95dd606c", "indicator--fa35d3c5-cd9a-481a-a12a-704b1ddfe691", "indicator--e2c08017-8cc3-4405-90dc-95839d16136d", "indicator--71d9624b-2788-4726-8c4e-09ef72cbbd2e", "indicator--037ad896-5443-4c69-9482-70662b7d86e9", "indicator--f32d2c5b-bf33-43a3-b342-e8c163a48530", "indicator--97900389-6bd4-401f-8913-8b7f04ff2a48", "indicator--6a79e04f-5d59-4f85-8ee9-6c84a186b995", "indicator--920b7b99-33c9-4a85-8e57-6da5fa75e64e", "indicator--1f3b4ec8-1130-4a12-9cb6-4baa933f6af3", "indicator--67d87556-3139-4424-a61c-45c70644758f", "indicator--6da13d83-a956-4610-8353-29f4bdc0aea6", "indicator--3dba6322-1621-421a-8091-9f0368c0b4c3", "indicator--8a1cbf01-859f-48c5-8279-84f29ff05ca2", "indicator--d7072f8e-50d6-4f9e-b6ab-35d6fd1b94ab", "indicator--eabf7a08-65c7-4f44-8d1a-4548e53b477f", "indicator--a53ee228-9177-4fa4-a64d-9204cbed73b2", "indicator--7885f7b5-56f2-4c0c-8d43-8ad64b1e8080", "indicator--5681934b-2d4c-4fba-9bc7-6764f35d0d57", "indicator--8f916cb5-a0ad-490e-b1b0-e422e6f65873", "indicator--85a275c9-9e07-464f-898f-d22c3e32aa77", "indicator--b5832505-6711-48e4-88ee-868082293ade", "indicator--0d276517-d7c5-4903-9289-96caacba298c", "indicator--7f6c574b-8eaa-4e41-9419-4e3659e16233", "indicator--02b343ac-48bd-46d0-9c09-efa8547544b9", "indicator--f7ca64ee-f1a5-49f5-800c-af6c809affc4", "indicator--9c72ba6a-0b84-40e9-a4f2-192b62883991", "indicator--c9a1b392-6256-43dd-8d0d-deafc4ed680f", "indicator--45cbfab0-4971-4232-8f66-400ad1b314cd", "indicator--fad79556-21be-4d62-a5a3-ae4dc9ab7064", "indicator--db28fd8a-5b99-4066-8521-73203db25371", "indicator--e15960dd-ab4f-4e77-9cf6-165fe5d7aaaa", "indicator--c4c4713b-40f1-4263-957c-8a353366b126", "indicator--4441797c-8919-4093-aa84-c29f2006eb80", "indicator--c7f8d3c5-a426-4a39-94b0-14edb927eeb1", "indicator--4320dbaf-c1db-4a5f-897a-c069fe995726", "indicator--7a5415fb-2f73-4ec2-8c2d-f9aeb8149f50", "indicator--e3f7f230-3d35-4191-ad64-ca5b37273180", "indicator--16f71f1f-3f64-4e57-ab52-7b29fe7ef8d8", "indicator--a4275f10-7ba7-494d-908f-a1e91d2341fc", "indicator--7f7052d9-8cac-4487-bb44-940dac24ff98", "indicator--2bfefe26-d65a-47ab-b173-625d121dd357", "indicator--83ce74b5-ef1f-4a27-a27a-7cff91866dc7", "indicator--f85a402d-55cf-404f-a48b-63be848433df", "indicator--12f6d255-ea44-4166-9e64-ffde47183d37", "indicator--fd7ded15-f914-4d64-b959-c454f81b3593", "indicator--5a5b91ec-bd73-4129-9630-074ed54fb7e6", "indicator--a0465913-73f8-40b7-a763-41778418300f", "indicator--974c0b1e-f112-4e87-8c9c-a6eab51b34c8", "indicator--6fab2e1f-4907-45ee-bd7a-1a08ced1a986", "indicator--0e611052-8879-45f5-bf12-c6138242df66", "indicator--e8dbcb6c-b68d-4b0f-a4e4-3a6c43c32ec4", "indicator--96d14f15-9475-4139-82fd-fc221fb6ba23", "indicator--c9762cc3-b9cf-485d-997c-8c43c2f05907", "indicator--3cf5727d-c929-4c3b-99d8-02117c86a94e", "indicator--21304874-be8c-4ac6-9831-bb26be7f82aa", "indicator--9c5197d1-a5f2-45df-bc50-3055271ea1f5", "indicator--fbbeaa9f-ad4c-4d66-8259-c0b1a112362e", "indicator--d48b1ad2-0356-429b-ab16-8c9e8fb2c520", "indicator--ebeb349e-4836-4622-9346-5c57c52c2867", "indicator--b8b60420-a48f-45ec-968f-2a212edfcad4", "indicator--462c28a5-43d6-420a-9843-043ed1d85df4", "indicator--ce4612d9-38a5-438a-a1d6-372c67647f78", "indicator--ab0d0571-2aa4-4b16-bdc2-010610bdf11e", "indicator--97d54ba9-5a25-4982-9aa5-f95b81d419ef", "indicator--73f18328-d004-4b87-b314-179c2febe3c6", "indicator--ddd4c9f0-a568-4aaf-b6d8-96ff51ddb621", "indicator--4584a97f-ae50-4051-b22e-84e5c4018197", "indicator--b16919ab-5d95-4dda-b16f-622cb14bdde5", "indicator--4eecd236-dc19-47f3-a35b-05e47aae029c", "indicator--7278d477-d8b8-4eda-870f-2bb3fe46b85a", "indicator--c2e0fc1a-9cd7-4c5d-8d3f-d3769e491dae", "indicator--7ad989ed-0f54-45f8-8e16-b3076a4074a7", "indicator--78731bdb-e67a-49ca-b9e5-c0dcff2d5d6b", "indicator--ecbab043-6ac5-4734-a1b1-f0682fda9f68", "indicator--b1aa9502-c648-410e-912e-a23159c9bed7", "indicator--cddf6fd5-a92e-4199-a0a6-53b13b1deb2e", "indicator--ca40074a-0086-4c22-861c-b7182ddb4f48", "indicator--f59f1b51-9011-45a8-b729-3995aadaf45e", "indicator--bcb5f486-9efa-4659-b3f0-3ba129bd8d97", "indicator--c5645e64-ce72-43d4-b9d1-29df76254f97", "indicator--562c0b9e-8c27-4bbe-80f1-3f68586ae9ef", "indicator--8fae9d82-256b-44bd-9871-f025b5769c13", "indicator--a74b0919-0fcf-490a-883e-a6cd2519cb6b", "indicator--03f1568d-24fc-40e2-9822-8165031567c7", "indicator--4e3e24be-5dc3-4165-a302-48aaf27c97ee", "indicator--623d680d-7e91-4d7c-a3a6-ec0dc3a00b56", "indicator--5df38765-71a8-4080-87f4-988aafdfe1cb", "indicator--b9d2e924-1f2e-489f-918b-25fe48a8e259", "indicator--b20e1d55-c33a-40d7-86fb-a0c384f4de7f", "indicator--7554d083-b048-4d95-8bfc-25c290c2df39", "indicator--55e3bfc4-fb8d-48a3-b0ef-4187dfd2ee52", "indicator--46744ca2-180e-452a-9ef3-43fbaf9f10b8", "indicator--0a62e6c4-5659-4547-b62a-369fafd0e86d", "indicator--a9e7198e-a20f-45ba-93ab-fbdea0ff0129", "indicator--deda0ae3-06c3-4e09-9836-7c501f8d517e", "indicator--f40f057d-2f22-4d29-9e63-469eee3b969e", "indicator--77117eb4-a914-40e0-85fd-3323ef9f1fda", "indicator--98e02910-1bfb-4fe4-853f-f9b6ad996b71", "indicator--c8c181a4-b0e1-4d01-b213-267c92f74ab5", "indicator--74395fd1-b37f-4a1b-999d-f88429aa89fd", "indicator--09658e91-8794-40df-940d-04c1f2987415", "indicator--31843d47-a2ee-4018-b1d9-1607471dbc19", "indicator--6b4b2302-20fe-4c75-b55a-7674fce9de7d", "indicator--af189c33-bce8-4171-80b2-2d455817bb70", "indicator--95cb8541-9463-43f7-82e0-2e3d1a22244e", "indicator--72d13350-91f1-4b58-8583-0d782cf5ed1c", "indicator--dfded4b9-89c6-421b-a025-7c11be42d158", "indicator--b36344b6-155f-4379-9f96-e10d920d434b", "indicator--c7536747-8584-46bb-b9d1-9d04879a9f53", "indicator--a7a1cc37-642f-4d32-819d-f13e0ddd0644", "indicator--bf8774c1-383b-43bc-a564-8bde60d0d5d0", "indicator--2ef0022d-9f90-4b55-9634-40f4fbc1bab2", "indicator--56da55f5-04bd-473e-92da-cb9160327ce6", "indicator--145481e1-951f-4cc9-85de-b34ef100ec09", "indicator--c74d90bd-52f6-426d-980d-b9b9c8099587", "indicator--60e57435-bb4f-476e-8e7a-36514fadcdcb", "indicator--44f3312a-17b8-471a-ae42-101c29b2e851", "indicator--e031a0ba-c3b0-49bc-9bac-e09062bd9527", "indicator--cda7eae7-2add-433d-aee6-6ff1670312ed", "indicator--e671a4b9-6eb5-468a-884c-f7725ef940fd", "indicator--30316204-a534-48a4-9350-bd8f30900a44", "indicator--a02285c8-1177-4dcf-a986-76c14c026c70", "indicator--0a137944-f601-4780-9139-914642ddfa61", "indicator--2852216d-8de1-4f47-b03e-07b35729dc1d", "indicator--7fb0e5ae-46c7-448a-9ce1-b557bcd744bd", "indicator--824a26f6-2d81-4fc6-bbcc-f5c78e010604", "indicator--298a3ede-f483-4ae6-8c04-7c372641b927", "indicator--73ac64a3-7756-4587-bace-337d0e3958a3", "indicator--2f753ee1-0a14-4243-9408-dc875652a672", "indicator--1a8f44f5-3c97-4827-9c83-848bf4f30924", "indicator--d4c53910-b8b3-4bb3-a56b-f4e6aaf0ea8b", "indicator--9cada7e8-5317-4f61-a1e5-7e53d335505f", "indicator--0ce5a892-64fc-41b1-b732-c9fd09cca942", "indicator--7980f069-6b12-4f1c-a48a-ea67b1a7d766", "indicator--d2ccf340-f75f-4e06-904c-e0a7b5b822a8", "indicator--a4910562-85ee-4191-84b3-6f734401455c", "indicator--8b38ad51-6f09-4e8f-a2f9-be537703665d", "indicator--6f6f2730-dd80-42b0-a23b-c4c09ba4ace6", "indicator--cbffcf1b-9181-43df-a2a2-0c221020acde", "indicator--4c312c81-8f0e-4f4a-bc77-df68697ead4c", "indicator--262ebe9c-09b9-4a70-8707-3f43be218e78", "indicator--ba3f2dad-65c7-4f2b-bf14-4bf6083d003c", "indicator--ff878532-d051-4548-aaf9-e43eb4970c2d", "indicator--324e5e16-42a6-4de0-b90e-9676d6147341", "indicator--23a96b64-c816-461f-be67-8824262dce3e", "indicator--b64d314d-821d-4e80-b7c8-8c8be08f6872", "indicator--96910675-e0b9-40af-86c2-8b2ed50c3158", "indicator--38632413-fb14-45b5-9f41-6c29dc2e698b", "indicator--1b6cdf5c-5bb8-420b-87a9-6cad2db914d2", "indicator--171c6c18-7fdc-46b0-98f3-9da30c07aefc", "indicator--5479cbe3-c1cb-40d1-abef-cebce50770f3", "indicator--38810c97-f4b1-44a9-aac3-c3b794a46d5a", "indicator--70ffbb80-b81e-4ff1-a389-3c229d1f9ad0", "indicator--c2c5f52e-eef7-4d9a-ba0c-7d79e7fa90a5", "indicator--375e184c-a95f-4c39-bdc9-84e601cbca47", "indicator--8d317147-bb05-41a8-be1b-b796668df926", "indicator--a59bd62b-1e62-45a0-a183-ac66f4c9402a", "indicator--f0f7db13-5605-487c-9e58-9d0661dca551", "indicator--71a5cf39-622b-47b1-a7ec-287dea33a98f", "indicator--1f892edc-8fcc-4623-96fc-23d338c9d138", "indicator--337673d9-f64f-4651-9020-928875de7aef", "indicator--ad3464be-6c06-4f5d-b00a-2d18a0695ed4", "indicator--7bcee098-4e07-40d3-8e99-e766bf518294", "indicator--7b6340b2-aa25-4fe6-ae7f-280f3b2fc25a", "indicator--5f6a7219-af3c-4ea2-8407-b18432ea0313", "indicator--0b36f693-2a49-494e-9ea3-fecf2b8365b2", "indicator--5e604bc2-57d7-439b-8e2f-36847e68a6e6", "indicator--e8c783ab-e154-4631-b530-01ac919171ce", "indicator--02c84579-fc71-46d3-b834-cbba2a0d6601", "indicator--f787f4e4-c287-412c-bf3c-8e7731cfe4c0", "indicator--ae3d1bd0-83ab-4990-bbc6-98acd4f7a789", "indicator--45eb91a8-caf9-42a7-a30a-620270a286cb", "indicator--fd644e0b-c3c0-45b1-a61e-c939d4de4c1e", "indicator--4c6192c7-acf8-44c8-94a7-5ad44d1352ea", "indicator--393efafa-66b5-4c60-8afa-6af3abbcfb5f", "indicator--9cc82636-eb0c-452c-9f00-437f44cca8e6", "indicator--fb3c51e4-cfe2-4881-9fd3-0a1888029d7a", "indicator--a7c302e0-c99e-485f-9d77-a74725f7d6cd", "indicator--dc357728-3c34-442e-beaa-ad7407a9152d", "indicator--06542efc-54d7-44bd-a188-863e58d4e694", "indicator--5d143d56-e7f5-443d-9b65-b40b5d0e8e67", "indicator--6f3228d6-d01e-4450-bba8-54fc866213b4", "indicator--90d05d7e-f230-43f3-8af9-10506fe94c83", "indicator--67738b48-5807-4e40-b9e2-cbf949423ffc", "indicator--facc7adf-bc01-4e96-8434-be689411ee00", "indicator--01f34261-9fcf-441b-9ce8-3bc7fbfad335", "indicator--50255ed1-d2cd-4cf4-a06d-c277987d4580", "indicator--9b8367b4-2e68-41f9-857b-54535cec24c9", "indicator--b20590c0-dd87-491e-abc5-81631b20bff1", "indicator--1e872fe5-07ad-4913-b519-e945e314f082", "indicator--3d04e208-314f-41fb-a1bb-15f7be2c6564", "indicator--dc7ce702-0fba-49b0-813f-d7dc00910563", "indicator--7a7ba87a-7885-4429-b905-b90b3c2f48a2", "indicator--98cc4179-9c60-4952-adb5-65be9e1db710", "indicator--98274255-9721-4348-9009-d7377d8ff1c7", "indicator--b143ebc4-7af9-4079-b256-b00c8c48e1d7", "indicator--11328b8d-7027-48b5-801d-1f9259cba194", "indicator--61639a9e-9ad9-4488-bbcb-023065f887c2", "indicator--e3d48d87-27ba-416d-b86c-a2bb30c6e302", "indicator--5e785684-f53b-4311-a7e9-689d229db836", "indicator--8c681ce4-21e1-4c91-ac85-6ee342db4a71", "indicator--a66d2a7b-e120-48b9-8c0e-727c52070d1d", "indicator--3685d5f1-207b-4b9f-90ab-ff5ddf052915", "indicator--52e9ed6b-3ae9-4829-808c-5281ac031cc7", "indicator--47d4511d-4535-4ebc-b11d-c83c5edd0e3c", "indicator--d80c1154-417d-4bc2-8a89-9f8e75c0e0aa", "indicator--c6f2045d-1de0-4d4b-8afd-ab81cddd7dcf", "indicator--da341820-d9b9-4398-ab98-afdb1515cb1d", "indicator--bbf26440-5458-423c-a6eb-9634c0eaa8d7", "indicator--e89d3ed2-a0da-4861-8ba9-118b297e903c", "indicator--7747801a-206a-4635-9739-4834ff9f0b1f", "indicator--8fa234de-3c3b-4fa2-ace9-a9d7931f2f59", "indicator--8f856be1-5049-4d96-bdd6-c90e14158887", "indicator--7a3a15f3-5048-49c0-a5a8-a9369c6629f5", "indicator--d4fbf309-e9ed-415a-a209-ae9d8c5e6c6c", "indicator--1b90b66c-6897-45e5-8f25-0c696fe7ac2f", "indicator--82a244cd-6148-46e4-b054-ecea22136f15", "indicator--f521d32f-5293-4b59-91e9-1432f83b2998", "indicator--9a60301f-2c44-44c0-93d4-d9dc4573a0be", "indicator--5a643a8f-a0d9-4e69-ba27-f4a1d063dbbf", "indicator--bb2d2160-de10-40e5-8fc8-d6ede2dc6d71", "indicator--c1324ba9-b266-4fff-87cf-50a50eae52f5", "indicator--5f5dffcc-5384-48f0-9750-96e21bb71355", "indicator--ff8401a6-f17e-422b-9850-774357cbee04", "indicator--fda4ae9d-2659-4223-a461-86612d7c5f36", "indicator--2e40f768-f8ca-4d30-aca8-b3df511da315", "indicator--ee91bf9c-613c-41ad-a7b8-8b4d0d0ba889", "indicator--c80dfd0f-e91d-4f35-b313-3d7a7958c57b", "indicator--4d609456-7f53-4944-a98b-5b0ed79254e0", "indicator--3fe6ef8d-edf8-4784-bf94-bfc1a90507c0", "indicator--02b662c2-417e-46b4-b2b0-1ea86c975b85", "indicator--deb053f0-869a-4463-bb0e-51731a533e95", "indicator--0410b8aa-21b6-41bf-9bd4-8154f5ca0943", "indicator--74a8ac15-a697-4f7c-b5a1-cc7890327057", "indicator--a673e246-b6a6-4420-a617-ec19fd1ce989", "indicator--851e5548-3d85-4f89-9eb0-1b0df5db4f14", "indicator--8f23e8d6-eba5-4dc1-a19e-f28d6be63db3", "indicator--4f887e91-fd5b-4283-8f2e-3f11b933af89", "indicator--e5eef1ab-d294-44f2-9d30-d801200e01d6", "indicator--c535cfe6-f8c1-4563-b193-d2f7c631e934", "indicator--a7f30c52-5027-4728-9549-1e80452c7851", "indicator--77fc24d9-911e-433f-a19b-c7decf68bd30", "indicator--e660f68b-bdbb-4e2c-b510-a31b0e7aa6cd", "indicator--9ca9aff1-b3cf-4e89-a81f-f75e4c0bde71", "indicator--da1d5cf9-f7a5-4f2d-92d3-ae9358199ff9", "indicator--bb6b4838-2d0f-44b3-8444-fed4d6354f07", "indicator--c30f4047-0ea2-4d18-8812-9dd234227533", "indicator--8116ba9b-5f0c-4ae7-89f7-f54d7dc3d68c", "indicator--47aae697-7435-4d42-bf50-65c590fb86e7", "indicator--ce7e62a2-35b6-4791-b939-6155d24d5fcb", "indicator--ad659a32-a6dd-4776-b53c-50a664e61ec7", "indicator--77188456-7ae2-48d7-b718-0aa6d4684e56", "indicator--438900c4-e21f-46bd-9d38-1a2acf41b694", "indicator--4c240f97-b02c-4c02-85db-99de96a61359", "indicator--d2fb28db-3a8a-41dd-8462-67e5450b1ae6", "indicator--3a1d044c-b0bd-4e9d-a408-12a94b995355", "indicator--5f37d2e5-3a80-42b7-8a0d-8188c7d9424b", "indicator--3fbb2d66-212b-484e-8407-4a58a56c4314", "indicator--183c736d-21ca-4a46-9342-8d3ddedd4a5d", "indicator--e99736cc-ffd4-41b6-bc0c-f281d776fb0d", "indicator--d893b894-c337-428b-b35e-cb761cde5d55", "indicator--074f7b7a-485a-4f82-9886-aac8f8eefbf1", "indicator--f7254ae3-84ed-4752-bb02-d4d8638172b7", "indicator--9aabe217-c57d-4c7d-a3af-d6857b2ee4e4", "indicator--aaa3181a-6ce3-4e25-9786-d280e8f59f81", "indicator--a5341928-11e6-42b9-ae3c-38caedabfe56", "indicator--426c7256-eeb2-4ae5-b60d-064e7f53b964", "indicator--acd42d73-9c8f-4643-a04a-6ca4a679b29a", "indicator--6d47100b-9206-482a-bc36-4da035be175e", "indicator--78c2f2ce-3e7a-453f-9858-4d7dc323b55c", "indicator--efbb101b-9c8b-4746-b621-a37c5d912e43", "indicator--f2302074-fa3c-4bb1-bdba-188841f05696", "indicator--ef36ba7e-9a8c-4b4f-a66a-e4cd3ec1ae97", "indicator--1f1eee08-b3aa-4c7f-9209-be56fe908467", "indicator--18a2ac52-b10a-470f-8114-a2498371a81c", "indicator--144429a4-b9fa-4128-861d-ed1afc35eea7", "indicator--8066e2cb-1fb1-4afc-9b22-b15ac06c9db9", "indicator--affbec73-8376-40ba-b80b-f0c93affe6cf", "indicator--2e12d74f-047d-4239-9fe3-d8558dde0295", "indicator--d9d10760-2fe5-44d5-b5c0-03412ceda53e", "indicator--24c5725f-1359-41cf-bcae-6d434df0502f", "indicator--87052395-9087-4e76-a6c6-0e2b2201e81c", "indicator--4aca49f9-fc28-41d3-81aa-c6847a9ec7da", "indicator--461d2bfc-14e9-4d5d-aced-ed49da7d150b", "indicator--8d52949b-1d56-4adb-bb71-7ece4dac402a", "indicator--cfcc4ca4-f352-4402-9248-9914f18a3e47", "indicator--b926de67-1adb-41de-a481-e0a00925e653", "indicator--a0b7d801-be2f-4205-aff1-38a0cf5a0b2c", "indicator--54ca9306-7da5-4df0-bb83-75838589039b", "indicator--b6bc8aae-a714-4ba9-9515-470b7f31b27e", "indicator--540c102f-bfd0-40a1-8a88-502618f1b99d", "indicator--2ef55cac-12a2-4ca5-af4c-521d2b5c0b8e", "indicator--547ba0d0-4353-4b8a-8eb7-b261cff8860b", "indicator--d145b293-61fb-459e-9b74-60e31b49f241", "indicator--9e24ac01-8d68-457a-b6ce-058e47104514", "indicator--51de3d98-d55c-4b6f-8fe1-7c9800752967", "indicator--c8cb2dcb-c6a3-4449-baed-206a6167aba6", "indicator--bf8ec240-4815-496d-9a3d-37afeb2f1e25", "indicator--f0c6f6a6-054a-4cc5-b370-dc3030bd8fee", "indicator--b00d305f-9b12-497f-ba3e-50d2ec11f487", "indicator--c0528f54-a84d-4cb4-b364-6be187b99474", "indicator--5e7b0496-e382-4ea9-a6d1-7940f7f73559", "indicator--4e35ef29-738f-4880-9d83-6af2ef79a154", "indicator--10ef432e-40c9-43b9-843f-347cdd323176", "indicator--764fb6c5-dcfd-4576-abaa-939188bd4a44", "indicator--28a1f7b8-a1dd-47e7-87e2-0683dcdd3545", "indicator--f9bc415b-8798-4634-b3b5-8d19b2f55acd", "indicator--3377157d-70d2-4a65-9194-74668906cec5", "indicator--6c00881e-f35a-48d7-b07f-2e24256784c9", "indicator--0d696cd5-3c03-4103-9620-a702d6bbdec1", "indicator--a80a0f06-c397-4b70-b683-149d6cda186c", "indicator--87f35224-83da-4836-a521-f14a9ced1286", "indicator--c31aeb32-5c1b-4061-97ce-cf4a72d991c2", "indicator--44a3ff41-475b-43df-bf5b-06af22471151", "indicator--8ed87e82-aa1d-4c7f-bb26-c796a460df41", "indicator--1403193d-3d64-4fa1-b760-ab24d0a8e7e9", "indicator--e4bd43e7-7785-4370-99d8-f272d25e0cc7", "indicator--f43a8d91-76bd-4920-b03c-ed179b33d1ff", "indicator--30011373-8388-4de8-a1dd-6f8248e5aad2", "indicator--ec16e51b-c985-4412-a0d2-f623ddc8d15c", "indicator--5bf86ea8-7aa8-4eef-9d6e-7dd9242d666b", "indicator--7cf85a5f-b45c-4e6a-8c35-7d6491db97d8", "indicator--f819458f-ad2a-4b6a-bd33-bed228a00e41", "indicator--e7d35862-880a-4749-bdda-fc800180938e", "indicator--be87bc77-da6c-45ab-93c0-c3e27a32d6bd", "indicator--88ce8ce2-c545-4a7d-8c86-73d38f2b6c1a", "indicator--40978a70-d4b4-4ae0-b253-2740c84da8b9", "indicator--d2da7d74-2a4e-4ce0-b949-579c9f6b07d8", "indicator--8743bf02-d402-417f-be81-902c4914451e", "indicator--76b0e95e-42fd-4213-ac73-2673696a0c1d", "indicator--dbc95aef-fda8-4098-88c2-c91fa2776b61", "indicator--7be8a1ca-6c5f-432d-b3ed-5dfc46b11d44", "indicator--fd4029a7-d10f-48b0-843e-f7021ee2826b", "indicator--def4083c-fa04-4551-9a72-8bc136c4955b", "indicator--b90a38dc-5752-4c2b-ac68-58df9e65b17d", "indicator--ce9964e1-f3ef-43e6-ab0d-821e5138bced", "indicator--b2bf1b09-2e1d-4542-84bf-9d32463cb4d2", "indicator--414a31c0-5344-4265-ad48-8470a0dd7938", "indicator--32a200ea-76cc-46c4-844d-37f64f03a408", "indicator--cab06552-53d3-4df3-bce4-fe0dfde73821", "indicator--5a84149b-357d-4706-9dcf-06ff33a7331b", "indicator--49370197-c830-4e11-8b92-ee3d3a7ca0b8", "indicator--a5146e0b-853d-48b2-8932-efe5343a42c1", "indicator--8941eae9-0627-4188-beaf-73e73e7ed138", "indicator--f7698de8-f603-4c5d-8a26-adaea4ee3ab8", "indicator--b54bd36c-05fb-4a94-a41e-c34934e51fe3", "indicator--9e474a71-fe86-4b62-bd0b-0eed5d26ea1a", "indicator--bb0bf104-b400-4bbc-a9b5-3fda375b3421", "indicator--2323b50b-52ab-45e3-a9e2-c4ff42dcf656", "indicator--77c1bd76-09b9-4ba5-9874-42d5f5414610", "indicator--4acfce48-ac38-42be-87ca-479291134483", "indicator--17d4fece-9c7e-436c-a9fe-edad48a98593", "indicator--9322c474-73d4-4482-bdb9-42944cbe14d7", "indicator--69bc9986-4b23-4558-8c99-3da701e025f7", "indicator--3a64cdfe-d244-4048-82c4-b2298ec10567", "indicator--5114f358-10ab-4051-a0d9-fdc1c62bb101", "indicator--cba62975-5f95-4b68-9b79-7329c6157803", "indicator--5810ea8d-5e61-43c9-97cc-b5ad4bf18195", "indicator--cc12f56b-4ee1-4430-bf83-4ab4b7a877d7", "indicator--501a62cc-a4a9-44f3-80ec-817d03ab67a6", "indicator--a0e08a74-625a-4e8d-9172-52aaaed42c3a", "indicator--5d7cff93-d043-4fab-92a0-4fd1707a752e", "indicator--2b6c1564-e115-4f1b-a2f0-0f0513bd8249", "indicator--11d6c201-eaa6-42b3-8610-2ed7106df239", "indicator--bc270dd5-8e81-435a-b0c6-6c7c0467d047", "indicator--aa15a626-bc5b-4ea2-9054-5166eb630537", "indicator--4f29f079-2705-4272-8df4-8600cc6871e6", "indicator--61904a73-ffba-4a9a-b353-5825aec3c370", "indicator--f2590649-e76e-44eb-a323-145bdc8f36fc", "indicator--8c933792-9ed5-46fc-a789-16d6b328959e", "indicator--9746745d-30ac-4895-aac4-dd772ec1f2a4", "indicator--0fd71aca-a56a-4d5d-a224-34ce31a210d1", "indicator--1e2f61c2-3462-4da3-a4d7-ee4e212a9a6a", "indicator--1f1a8bea-48d1-4dfe-bc23-0b4f25c78568", "indicator--e3c404d8-7b45-4650-84e1-4e404b4154f6", "indicator--f54b05cc-6e76-43ea-8bae-cf3cbca681b7", "indicator--ac53dc44-5f89-4066-bb9c-36d94a5bbc83", "indicator--b2d822bc-c813-4f95-b913-21a691768955", "indicator--8d0d6f34-8564-4a7f-8683-27d8b47b34e1", "indicator--bb8d0218-3f4d-4723-ad53-f10cbc90cf29", "indicator--208fdf36-708a-4358-ac54-d31d5c6a2c48", "indicator--c515d1ff-4e9f-49fd-ba29-f876c573e60e", "indicator--c03cbd6a-cc83-4719-9760-eaf20a62360b", "indicator--14410431-68db-499a-a021-7c7d7f71b938", "indicator--2e9e20dd-3dfb-4e11-a985-8217a588a1bc", "indicator--d7c41493-f0bc-4db2-a3ba-9cab7364f450", "indicator--22243e50-71fa-4c3e-a901-99af4cf23708", "indicator--6a1b1e27-d60a-4803-9810-8a50b0cd2a59", "indicator--299fc746-4158-4fe1-8372-79ddbd1969ad", "indicator--6bd7cdb7-2608-4549-8bbb-8404e32b64d8", "indicator--97d63c20-f0c3-41bb-9426-a2d1af321e9b", "indicator--8acfa72a-7841-4ea8-8e2d-1364204adc6d", "indicator--464ccdb6-e996-47f9-addd-14515b438ef3", "indicator--b2ae67a1-a5f3-4b95-ae66-9df68c3eca40", "indicator--2d8d0620-6316-49b0-a046-4ed077523a00", "indicator--c7096364-fb85-4488-b2b8-2d9bb1f98140", "indicator--60e1c388-efae-4f6e-a43f-f89827dc427d", "indicator--b3389213-2e4a-4b1f-94b8-11fdac444748", "indicator--dce0579a-b07c-477e-a14f-b75e41b9e2f3", "indicator--fbc84eef-8b45-48b7-9f80-702c91daed54", "indicator--a6a42204-ba00-4990-8cdf-933481f2a0cc", "indicator--2cbfd9d0-13bb-4945-ae1b-0eece81555a6", "indicator--b6d8a4c6-c3dd-491f-a491-6cc3517ed128", "indicator--30b84b8e-93dc-454c-9877-fc7fdcc7280b", "indicator--90fce7a7-9e52-4625-a6ad-ca757fd2f24f", "indicator--a533ab4a-e206-4329-a570-035d526e1d0a", "indicator--3e11fdc7-9d85-44fe-bd1c-df313224d8d9", "indicator--d88d597a-11d6-4cbc-b97a-8b63274f625f", "indicator--0e0f7a57-44e1-4dd5-af77-5f7c77a96b7c", "indicator--f65a5df3-0a6e-47ea-9b49-24810b123ab5", "indicator--0f6ce7f9-9971-4270-b535-ca11304df4f6", "indicator--fe3f2fec-9291-4825-a614-5c1cfe14b908", "indicator--1cd8cd39-e957-43b6-b53f-6cb10d532536", "indicator--c47423be-468a-4157-938a-61f38b292852", "indicator--3bc3b490-a5ff-43a3-8927-f9ca7145cb3e", "indicator--f71e351a-b821-47a6-b9ec-0449f3dd34c4", "indicator--a60eb644-9c21-41ff-a635-25090a727dfb", "indicator--876cdf32-9393-4995-ae0b-f73f6f9c13dd", "indicator--5be56e54-c6d3-4f4d-a60f-ae52cd84e6aa", "indicator--88657df2-67fc-4360-a1b4-c67187ffb460", "indicator--94b41bc9-781a-45b6-ad2f-4fae392cb7a4", "indicator--1a773004-93d7-41f4-b6ea-f43f9606a239", "indicator--c669be90-4ce3-420a-852b-ca31473633f7", "indicator--a7c0d0da-e39a-419e-8fa6-4643a950e543", "indicator--144f284d-2b4e-406b-ab2d-da034f3448ae", "indicator--10d02179-5fba-4710-9334-fdb1cacb93df", "indicator--b5951b56-bfa4-4119-be29-609ae8ee3e13", "indicator--589a537d-de09-43a0-8c77-7f3dd8ce0bcf", "indicator--a436d36d-7182-49a8-8715-c6321409d400", "indicator--66dba217-f2e4-412a-a892-f79f2eff8030", "indicator--2ff9637f-c3e7-4ed3-976e-746b03f6df1f", "indicator--87f9caad-c76a-4e90-8fc5-f10c5f23dbd8", "indicator--efd2e073-fd04-458d-bb08-ab0e2e4e9a42", "indicator--459dbe0d-c7a5-4b23-bdf0-a1dfde34593f", "indicator--e8ec9e60-75cd-4de2-8adb-0993eb6f475d", "indicator--c9e41331-3c13-4758-b1d4-847e260f584f", "indicator--ed9eb410-6db2-444d-bd45-43d867ba99b9", "indicator--49bff32f-228a-4b04-81af-0319cf6a851e", "indicator--6e07b908-b5a7-4e7f-8362-3cd4513df034", "indicator--41afcbb4-bab5-456d-8ae0-d309b68b6d22", "indicator--e5381349-997e-4473-ac0c-5841821254ac", "indicator--bd4089a6-2d3b-4cab-908d-cb58af714f5c", "indicator--db6e0620-d49a-4728-90cd-a6e221d19627", "indicator--06999265-6714-4f85-b2f4-d09177a2ca02", "indicator--0dd189a2-270b-4e67-b0b5-af958f8891cd", "indicator--2fc83ecd-682d-4c58-8ef9-747bdd7b95fd", "indicator--a54fd27a-6c84-4e1d-8da8-1277f835ef7b", "indicator--f10114b6-920e-471a-8954-d4512878d42d", "indicator--46237140-9293-4579-881f-476ed54a08ec", "indicator--05920ed6-440a-4348-9d50-06c5e7e479d8", "indicator--4a8602c6-c7bc-4c51-9d0c-392f8b6a66c5", "indicator--5b28a421-1ae3-44db-b2d6-ed62e6cf5918", "indicator--18b22110-2056-4ea7-94d2-82e263486b7d", "indicator--c2441f0f-c43f-41a1-8cd9-4b14cd27e43a", "indicator--c6f744b3-c059-4274-8852-ac606482ee5a", "indicator--857b6eda-e4df-48b6-90bf-910b5f41af37", "indicator--4d71659d-bbca-4cdb-a818-b79847563b6c", "indicator--62e360c6-3414-4d48-b07e-806a7a292a49", "indicator--3cb38fa1-8737-4183-81f7-62e7764e1e9d", "indicator--c8f1a017-ad1d-45f8-8fbb-f8e914cdf3a5", "indicator--be337f6d-fc87-4915-a905-eadf0b9f72ed", "indicator--709eeaa7-6202-4f45-923a-cc2ddbaf5526", "indicator--1a4a594d-3c26-4881-bfe7-ed5074df2fc0", "indicator--ab7d3570-7bfd-400a-8929-f2b383e775a6", "indicator--b716961b-1fd8-4cf8-a6cb-b658f4f9fa3f", "indicator--cc8c36f3-5a06-47df-8151-682f41c39320", "indicator--eb19dfd4-8623-42dc-a946-f84f24247b29", "indicator--f548ab48-abc9-499c-b88b-c37ea9ac2b4e", "indicator--88b04d1e-7ec2-44eb-a3b4-67cb68cbeec2", "indicator--3dff7831-eb52-4f30-8531-a476a72a8635", "indicator--cdaa2304-a85a-4f09-8fa4-46bedff367f2", "indicator--c7235020-593e-4ceb-aded-608708bbdc97", "indicator--2cadd235-4457-4101-bca1-627ff6740269", "indicator--e554f393-47d6-4814-b59e-0d91ce9c0ffd", "indicator--b3680115-04ab-4367-a687-a70429f28a3c", "indicator--e994cd23-f08f-47e8-8d89-d74db289bfd1", "indicator--12071aa0-63e0-4ef4-b3db-af0cef00caa0", "indicator--7026ffbb-06c7-461d-9afd-a0d25297adf9", "indicator--7be6e8cf-6c34-4541-85be-1f0c71eb2866", "indicator--3128f4f1-6673-40e5-baca-62dbf3cd3a94", "indicator--888fc8a7-4ed7-4bbd-88b1-3f831580d1af", "indicator--d1f1f630-7e4b-435d-9945-ffd0b8ee7bd1", "indicator--e154e8a7-6e1a-4c39-981c-7c6f80cc841d", "indicator--49e5a1be-76d9-4fc1-890f-131eff054bf2", "indicator--5b7610be-0643-43aa-805a-b43a5e920f6a", "indicator--c768b119-9c41-4bd8-9f38-63c7f25becb5", "indicator--8dc524a7-c878-4f25-a31e-ccdd2955851a", "indicator--9cb1b1fc-fa12-48ac-963f-019ddbfb2d87", "indicator--c3ea3003-5d15-4792-9fca-248a739ded5d", "indicator--2d4ce7b3-1c40-4ab6-820a-5ef2b2a0f2a8", "indicator--cf1a6b7f-4ba7-4cf9-ac94-7fdf8f23ba83", "indicator--cc9f0162-61fe-4c50-9d9d-f35720516425", "indicator--f8dba2e3-cd5d-4e70-a386-c8bdecb9758e", "indicator--419bf3d1-b9cb-46e5-9d27-3f265ad3e9b9", "indicator--f68afbcb-c437-47af-a357-97632584286e", "indicator--42b86658-bb61-45e1-ac76-984ad4258404", "indicator--bc3fc6d7-ea0e-434f-b81c-30e5bc991924", "indicator--9396f1c9-0340-48b7-92ec-047313095c76", "indicator--d0ba8293-df66-4e82-bba3-41174c50e436", "indicator--b12569a4-4301-4f79-9447-cb4580f55194", "indicator--8afba18e-5c8f-4e3a-be27-72bf350b216e", "indicator--b23eb11d-6301-4b89-b85e-bf6450bbc657", "indicator--b111553a-411c-4a67-a094-45a363f2f164", "indicator--d338646b-eb38-4816-be2a-074c0894f43e", "indicator--704cff00-7189-41fd-8041-1fb72405282e", "indicator--92934d23-a663-48a8-9aea-b351da85ff56", "indicator--980e4b7c-57c5-4b91-a04e-5f69f5e739c2", "indicator--9f6fa5af-018c-49d4-b9a1-1b7bd32f4381", "indicator--c61bb739-5528-4213-a774-779f1fc5c6da", "indicator--58b96498-31ad-4b57-9bb0-24b384438e83", "indicator--19458349-02cc-40dd-8afc-1df03540bca9", "indicator--6ff68bf2-7ebc-415f-8816-aa943a3dfc08", "indicator--69f5549c-7423-444c-95f7-bdbf83008a1d", "indicator--514adbb1-7fd2-4613-99ff-e6aca45639b9", "indicator--e906feef-9f1a-4f1a-8dde-ba1d5543f936", "indicator--19be0332-f752-4479-b3cc-f3785f2017dc", "indicator--56c0ca6e-2e59-4a59-82c3-63c9b80922b6", "indicator--762b24fe-cf08-4bb1-b3d6-f1b289e38805", "indicator--6ab9180e-021e-4fa8-8aff-4e987c50c6bd", "indicator--e750d0fc-46db-46c5-bfa6-e51ac0265918", "indicator--0d47124c-35a8-45b9-aae0-2ea8cabf0727", "indicator--4426043e-722b-45da-8019-191826023751", "indicator--2c8bbb81-3b66-447b-bfa9-a7ffcfe90fd6", "indicator--62b72b89-25f1-4e5e-a1ff-9e6ad7add5fc", "indicator--2f471234-3caa-4003-b153-ee5702432eae", "indicator--6333acdc-a856-41a0-9630-3e9acd7dbb7f", "indicator--a02a70ff-c886-48aa-81a2-23015a2800a1", "indicator--53370b60-9653-4d65-85ca-519bbf172d4c", "indicator--9606091e-4069-42f9-9e59-30d20f4427b8", "indicator--4eb6dca6-3309-440e-9fd2-7aca21aefd64", "indicator--74cc2d44-c303-40ee-a43f-9fef3505ecce", "indicator--e0e62364-4110-4cf0-af87-0ea41119142d", "indicator--56276281-de62-436b-9f46-827c08b527d8", "indicator--0c86c0c4-7bce-4de2-b085-0f8350b7d996", "indicator--51142e0e-0c37-4caa-bdf5-601a8a202081", "indicator--bf952490-ea83-4656-899a-b493e10eed42", "indicator--a16052bc-ae85-4e4a-8ace-b996ba4205cc", "indicator--59021fe5-a9eb-4432-a0d5-9f182285b0a8", "indicator--6672f4d3-2e8c-440e-b816-224171fbd8b8", "indicator--a0eb9648-6e9b-4fc4-b332-c5d08f20fd17", "indicator--48d18841-cc23-43c5-a38a-13aadcedd906", "indicator--8331f490-6fdb-4ddf-9ddd-a01a4aff688f", "indicator--e1fee7d2-33db-400a-84cb-58819d99ecb0", "indicator--a45391d9-5315-450d-a714-229dd1065105", "indicator--10685382-19bd-47b4-add2-fcc9fce2b290", "indicator--ec407664-6615-4ba0-ae03-dc7df7202caf", "indicator--7a9b8259-262f-46ca-90ae-1d338ce9db53", "indicator--4fe3b3a0-e2b4-4023-8e7e-a79e31b1dbae", "indicator--08fd8836-f5e6-4723-b47a-de423a2aace4", "indicator--a78d8eed-67c2-4b2b-842f-0159887ef869", "indicator--eb479e08-3c04-4408-90ed-e8ca47887691", "indicator--9745f754-7159-4d44-8a5f-dfe67b1bdb43", "indicator--a0456e32-86b0-44f5-a331-6dbe21b45f70", "indicator--8a208b45-6d58-4534-b139-94fa85bcfedd", "indicator--e2bf4b33-f096-46b7-aba2-91a420c79a61", "indicator--68a404bf-671e-4aff-86bf-0f34d39f6280", "indicator--f0aac203-65f3-48ff-b06e-db0d5fbb8aa6", "indicator--875ecd19-d178-4149-9ecc-4105b2070132", "indicator--dde235d2-a078-445d-8f07-7b1b59a3ef0f", "indicator--701b7932-e835-4177-b32f-d17425bc8727", "indicator--442ea33b-bd99-4850-a028-42713dcf706a", "indicator--b212894d-46aa-45f3-99bb-4962aaa6ac3d", "indicator--6935a007-651b-4230-aee7-8dc5a2ae6b13", "indicator--49ea6d0c-a491-4faf-ba2c-683b855c4a46", "indicator--7b60d28d-60a6-4a12-ba08-f3c52935a181", "indicator--a1044b18-7fbc-484d-823d-1e12b9f67057", "indicator--2a359cf8-cd75-4016-8326-78d0cd6d201c", "indicator--b851bcee-5e28-4b39-a5b3-fa454fdeb803", "indicator--68d40d08-30f7-4808-a3a6-ac9efefed51e", "indicator--b468d775-a144-4546-9902-bfc86102995a", "indicator--6c5d6e5d-459f-4463-a4a8-34ea27825433", "indicator--9b44b8af-6d0d-434d-8b7d-dd5b764033ab", "indicator--51856c7c-a139-408b-a710-051326e0139b", "indicator--0f1ccd7f-63c7-4b55-80ff-693ee55c8a31", "indicator--f997a718-5dd0-4459-8c7d-64f4863ca7f7", "indicator--720a0deb-a7bd-421c-87e3-a6a591d6241c", "indicator--ccbd57a6-74cb-43d5-962f-be1430afda08", "indicator--af961e50-ed7e-4c90-89c9-ddd2927adb79", "indicator--631008cb-c72f-478b-9b09-e220a77b41b8", "indicator--83ead3b4-5f6f-439e-9703-99cc276ade4f", "indicator--a8bff395-d474-4cab-ba0a-4d069e181492", "indicator--d92ea274-f142-4be1-af33-7c0d6b9253c2", "indicator--c61ea404-00ff-4a53-a8e5-f9a03afac0c1", "indicator--e5532f79-8099-437f-88f2-afe087ed6117", "indicator--b9ea070b-41e7-410b-b1b4-55330b715693", "indicator--98d77527-f9a8-4193-8bca-60144e121ec3", "indicator--43cf8c9c-22d5-4d0a-ba20-2bbff3992f15", "indicator--2b642dde-5d05-4ca0-9a84-4ed6f3d04b81", "indicator--bd515632-4589-4bd5-83a0-131f0c336691", "indicator--502735c5-4b96-413c-993c-416faa4536d8", "indicator--56e46796-d32a-4c90-8ce9-e57fbccda8d6", "indicator--33850fe4-a352-45d8-89c0-b7dae8098fe7", "indicator--dd16f6af-cc4f-4c35-8ef6-9abe63e8e8bf", "indicator--0e7fbfe0-4ef2-4aae-a15f-9ab32905edcc", "indicator--7821608c-9e63-49dd-9bb1-1a39f05ec4e3", "indicator--8b9fb8ed-a0cd-491e-9315-86f7016ccf6c", "indicator--ba73a4f5-fb11-4cee-a034-d5d901e9b0dd", "indicator--45703930-d38c-46d0-a8f4-c326a82bbe78", "indicator--7579e941-a500-4ccd-894f-9407321dd53d", "indicator--b211fd30-8607-4e3a-945d-8446c3717eca", "indicator--8768b408-11a5-4f23-93f3-cc7f3a335def", "indicator--f83edf44-af48-4dc5-b45a-13a2dadc70c7", "indicator--57c06bf0-379c-4e59-b8c1-b74f06914f4f", "indicator--09b60460-7977-4a2a-a177-a92bd1706a4a", "indicator--45ecdf37-bed9-434f-a6f4-2642585d8ae3", "indicator--22d9fb7b-5e1b-4a14-b374-dfceaf58980a", "indicator--b36cbee3-7b79-4ed8-aa44-e709537b1e7a", "indicator--83bb2c1c-472e-4d29-b977-90a71c8e9f71", "indicator--73ba3820-ae2e-44a8-a08c-1a2f5aebd500", "indicator--a8ea21f4-2ffb-4cb8-b201-aa558b53a60c", "indicator--01d5cac3-3eb7-411a-9030-f5bc55579521", "indicator--8265c2b1-38cc-42f8-9b06-3dddc6c26d91", "indicator--14a9751d-6a11-4a64-b19b-858757617983", "indicator--3a6841bd-f682-4426-a653-d11592f365dd", "indicator--c5108bfb-3a76-4975-a528-06ddcd35222e", "indicator--e8b1a296-4cd6-4b10-b4d3-4beef6144efb", "indicator--769696f8-4078-4d00-9479-502eab6d7ef2", "indicator--6df51788-ca82-44f9-b618-1d0b6318a7df", "indicator--10245210-028d-46d4-9cbc-afadbca46d4c", "indicator--78b4b823-9212-4e75-a6f0-6134bbd04b08", "indicator--18717c5d-b3de-46fa-a5db-c5a0af3758ad", "indicator--48f91375-6962-4e50-ad8b-4dc6e2a6ce26", "indicator--45dbc58c-7da7-40aa-b90b-6d15fd1ae539", "indicator--56f666d0-8223-43ff-8cdf-aa6175b7ecd8", "indicator--c2fad3a4-a6d8-4ab5-ae8c-e78ac716c285", "indicator--d71d71af-ec52-4112-aa4b-53ba9acfba1e", "indicator--6514b9a5-39d1-422e-aef0-735946b1f5af", "indicator--2372def3-c1b5-45bc-80e0-845ea9135fd6", "indicator--6960cade-ac55-485d-b799-0363fac1b7aa", "indicator--b71e286a-8e3e-4c07-8b43-883f90411f89", "indicator--8a11d2ca-dc72-4bb3-b697-0a9348962292", "indicator--577e43f9-bc87-45de-b043-2bd3353fc2a4", "indicator--66d7f60b-ea37-4e6a-adf5-fd3382ea1f17", "indicator--15444d7f-f230-4ea3-bbcc-85ace51da75e", "indicator--d99fc67e-51fb-461d-8566-aeff3392c279", "indicator--a35ddfca-acac-499d-8142-c5e6e4f4ed63", "indicator--5e81178d-bcaf-455c-b6b4-406b19bd6bd6", "indicator--e1588203-1772-4eb1-af80-8d3ef5b93d11", "indicator--021cf274-af49-422a-a11b-cc66bb499c50", "indicator--eb6ee688-2407-4d08-b6e6-04f3f8605f7c", "indicator--8b0a81ec-a27c-405f-a7c8-42238eee2a5b", "indicator--57264d70-aa5d-4b96-9c99-d7e1760aa728", "indicator--67c8360a-fb27-49c2-b69b-95a49c858874", "relationship--1ccd461a-06ad-472f-bc15-bac9e7cf2d4b", "indicator--6bd380e3-115b-4ee8-b158-24aa7e606ab2", "indicator--8d53b4a7-31de-46a7-8590-7e5b544a061c", "indicator--b2be4a21-2da8-4f1c-97a1-9958c15cd3ac", "indicator--692b3f45-0b37-44bd-98e9-52ffa34e9366", "indicator--796962c8-3a3c-4021-9633-4419f337bf00", "indicator--1859dcdf-53a3-40c9-ac07-1ad17291fdb7", "indicator--81258167-6099-43a8-b6e1-29193ca8fcfa", "indicator--ddbee690-6d4a-4547-9f7a-f15e63758f72", "indicator--951de6ca-da7c-421d-a8f0-c6d7199881a0", "indicator--8e837268-ddef-44de-ab2c-68930e622a09", "indicator--95495307-d408-4fd3-9d4e-da4081eb852b", "indicator--db6bdadd-bfe7-4927-8ca2-8dcc76cf10f1", "indicator--b256f1b8-b461-4a4c-8e83-98bcc3af044e", "indicator--c8d2ec22-7c6b-4527-a196-a1b8b8439a85", "indicator--839d37ad-325f-4ecb-98ee-68ab143d1b4a", "indicator--b36e8fb7-e87c-416c-983a-b5d320abc165", "indicator--c74574d8-fe7f-4838-9c1f-297b48e6151b", "indicator--88bfaf8d-6a71-4c3f-8919-d73a7ba72448", "indicator--46cd4e3c-3247-4a51-acde-3a45178f107d", "indicator--b8dfd81f-0408-43aa-869d-9e488dd8d579", "indicator--a3068c45-1db8-4c4d-a17b-e95f20e9a062", "indicator--4e639dd8-1a03-4e46-af1b-ed98c4b6fafa", "indicator--227accd4-6c4c-4c24-9830-6740b48fb1be", "indicator--ea31ac6e-20d3-416f-9025-f83e412d3ea8", "indicator--0124d42f-f5ea-4dbf-a9c2-4cb0af0062b1", "indicator--96e356cc-1af0-40d6-ba93-62007dfb0e25", "indicator--3dda1d3e-461d-48ba-843a-abec1afe80c0", "indicator--dc4eb2cc-89a4-4876-8740-10251017445e", "indicator--e514056d-230f-426d-819b-9b694a782d26", "indicator--3597f003-a7ca-4239-8f2b-adb4fb29c2a3", "indicator--047b6989-c566-4028-a0bd-4eaff85d93f4", "indicator--6af59633-1c04-4597-84f0-eca260bf07f0", "indicator--d93cc801-f058-4f8a-b581-3394638956cd", "indicator--56cf9736-5066-4eab-9468-4a7ce349c24a", "indicator--85baffcb-c79e-44c6-b4d1-0d8c4b8ead2c", "indicator--549b27dc-fbed-473c-9036-5abbc05781d9", "indicator--34bf9d82-911b-4a37-9d65-d0a6f6963499", "indicator--8a33dd4d-179d-4102-b996-79ce82b45659", "indicator--2b91665b-527f-4242-9001-22d4c06dccca", "indicator--27700906-149c-4a9a-b96d-422306bceb1d", "indicator--d0d8d382-6b1a-474e-b89c-4c79fd95f298", "indicator--b95fde70-39df-4be5-bb2a-a784b7ae4aea", "indicator--94c9117a-154d-4d16-9268-fceced438ec0", "indicator--ed5c9f2c-1440-4d28-931c-aa1d1bf262b5", "indicator--9aa1da02-a6f2-41ca-819c-e25801b56ad4", "indicator--2da527d7-7ce3-4a19-b56e-836fb49d6794", "indicator--12aadbae-5ee4-49c1-b986-c505c2f3a11d", "indicator--04478b2c-e5d9-4960-b7d8-9bf0cdf85693", "indicator--c9586ece-4dec-46a6-a339-a923caab2f36", "indicator--c8d04357-aa2b-49f8-93fb-206bc6f393f9", "indicator--b5b54eda-939d-472e-a1d8-2093ca7e58a9", "indicator--7b0dfb98-7f97-4433-bd80-56394d082ffb", "indicator--0c46ae94-c95a-4521-9834-abf9884f61f1", "indicator--ffd20aa3-d9ba-476b-aacd-4f91f305cbe7", "indicator--c585d973-c03d-4345-b468-b942248d2279", "indicator--c3e9506c-7e85-4fa3-a12a-37e0b325b7bb", "indicator--b32559df-d7c5-43a1-beff-b99d5fb03a30", "indicator--b4f8aa9d-8eb2-4146-bf45-34c1e669c8c8", "indicator--19430d68-8069-4852-8d78-7a32a8926d22", "indicator--f55bbcc4-6096-4a57-8711-80269e43c012", "indicator--957532c5-f91f-46d0-81e9-d662a1e0b24c", "indicator--21a48221-ffee-47b0-a67a-9cb2806e996e", "indicator--d74ea871-fc49-4677-b9b4-7cceee259cf1", "indicator--2a813fb2-7699-43c5-9d04-bd1c1a6a72cc", "indicator--3a70f204-a7ca-46c3-85f6-1b2063432f43", "indicator--83f22f88-0967-43bc-9ad5-5f1eb1323e9d", "indicator--3b3c3f6e-c652-4c7a-a5e2-d8eb88ccc611", "indicator--a0a8d304-0968-49bb-ae72-11d811f0d924", "indicator--f5c6015a-0b5f-4255-b45d-c4c88d45f23b", "indicator--78baf8f0-8582-458c-896a-62380589eac0", "indicator--ab436fed-13ea-4f36-b33b-9d51aa3a116d", "indicator--045971cb-41e2-4677-a343-0c7e27c05e49", "indicator--594b3dcb-3f58-4906-be9c-777f7d4cf70b", "indicator--856d30ae-8994-40bc-bc77-4c6c659be563", "indicator--384a87f6-7a71-498b-9bc8-e8ed7c1e10c2", "indicator--60e52195-29aa-41ae-b053-9a0cd4ebdf1c", "indicator--3cd5b21f-5855-4def-9369-05318b0e54af", "indicator--d544a34d-92dd-42fc-8db1-7f5c783e88df", "indicator--33162aa0-9a58-4e5e-84f3-6ed4eb7d753b", "indicator--7e7fa52a-7c14-470e-b07e-3ace6aaa18c2", "indicator--bd0327fa-9504-4f67-ab04-1f4c2970822b", "indicator--d85ffeb6-3861-491d-9f62-a32600a48933", "indicator--8f2efc0c-0d3d-4ca5-89c6-0cbba7a06711", "indicator--533908b1-0668-4ae4-b90c-1b880fa8e781", "indicator--6fbfa2ec-72be-4793-90d6-7442e7b2cc67", "indicator--f796bc1f-8591-434a-8887-f93a1f268cf7", "indicator--467932ff-6060-4884-9f0e-48b43423f2d1", "indicator--c0fcab46-040b-41c9-b806-fc5430e2d248", "indicator--71c98bf7-58a7-448f-ace2-f1db9806e314", "indicator--87da602c-a54a-4d33-94ba-5d95b770ee64", "indicator--6e17bf6d-7d90-46a3-9875-b60150888df1", "indicator--cc725a04-288c-4a56-8988-aff92610fc19", "indicator--ad5f0f42-6d06-406f-989d-9c24eac4975b", "indicator--760c7213-e239-4b0d-af98-4a889cd6a22e", "indicator--50990dfd-dabe-4166-8e91-3c71fcf84629", "indicator--4a56825e-7b44-4556-8bec-57c99b3e264a", "indicator--0067466c-f176-4854-93a3-4708f16a0d34", "indicator--cbe2d677-8906-4d49-95a5-4cb622e91e8b", "indicator--ee9376e0-2b67-461c-884d-5c7ad97c0eb3", "indicator--ba7a843f-e78f-45ef-9536-f16ad41f91cd", "indicator--34731e2d-f52a-4fbe-8d5e-7c8a63da4b41", "indicator--b8bbca43-2851-4ab3-aa7f-98eba4f263e6", "indicator--5b599eca-b5c9-491e-ba07-0c7f81b9b9ae", "indicator--ab746561-2030-4dc6-912d-f34fafdf0781", "indicator--dd499f26-6b39-4094-be5a-21d00e47bd3e", "indicator--ef9d366c-2921-44bc-82e3-1930eb6059db", "indicator--6231ce04-a623-4039-b7a1-9a458f757d40", "indicator--dc2dd476-a160-4fab-a6aa-c194327178d0", "indicator--54120181-527f-4520-a21f-7dc6c06d9f8c", "indicator--d4fa623e-6497-45ff-a99a-bf5d0913f142", "indicator--ff38693d-8dd6-44a8-b6fa-6dabfdbe9d98", "indicator--f08b6956-d0f8-4bec-8523-2983a06ba75a", "indicator--20dcb6d7-67f6-477a-bbc0-78da7726a2c2", "indicator--71a24cc5-b20b-417e-9ea3-4ee5cf75c08b", "indicator--efb6e659-f926-4a0c-ac8a-abf4e5599fa2", "indicator--15395691-558d-4273-9783-ae170fd988d8", "indicator--cbf2899f-5b8b-4db8-a409-e5a97c233b9c", "indicator--72a74830-35b0-4d5a-8933-87d086cc176d", "indicator--9d1ac61d-f779-41b8-8b96-c568c3756aa9", "indicator--0de81710-b84a-4299-956b-6699a5eac790", "indicator--cb57cff4-8d49-4c3c-b5a9-0be1a73a0b1f", "indicator--5b9f0e7f-b4a7-45e3-8e18-5234ca78ebe6", "indicator--674a67f1-7706-4531-b695-7a07efabe96b", "indicator--700478ed-0904-4ca3-9ee0-55eb4f7e234a", "indicator--f0ef880b-714b-4ea3-bd1f-18583e17cb00", "indicator--c9b7bb78-0403-488c-8bde-13d11f066a4e", "indicator--5e58c392-6c1b-4e81-980a-098b3219958a", "indicator--6bfcf9d3-e469-413c-a91c-ad51755834e5", "indicator--0d63107c-b79d-4bdd-9b34-590f47cbd41d", "indicator--fd482b0e-b574-443d-a21a-4b69be3bdfc9", "indicator--1b250715-0886-4915-9ccf-e310dbdd98f8", "indicator--3248617a-948c-42aa-8e4f-0c567c94dfec", "indicator--884ec1de-8dd9-4d06-a8e2-26dbfcbeac4f", "indicator--39bb679d-2126-40cc-b75c-384d8fb8b2ed", "indicator--03a5bcb0-a123-4f41-a0c8-84337f9c8124", "indicator--85cab796-3edb-4176-9ad6-255cdf86d258", "indicator--214a8f79-c8a6-4127-933f-7f7be24d4ed0", "indicator--393c21e6-fb87-4990-9460-b3d549fd6c59", "indicator--5f208f71-1c9e-4641-8081-6e77612eb211", "indicator--3ba3822c-993a-4ffa-8048-b94dd04481bb", "indicator--4723e1ac-1162-406f-a399-f4137d1eeb51", "indicator--52bf148c-0e77-48fa-9186-0eb96e468582", "indicator--0b4bb747-bbdb-4ead-a287-b4c56ac003cc", "indicator--4137afae-73d5-4f79-a543-5c2987d2883d", "indicator--8fd8cf70-07c2-4d7a-b69f-1082f09a6327", "indicator--91aba508-b511-4526-b91f-3b80e0ce7da4", "indicator--cb7b2ab4-34f3-47f4-955f-0b0ca2ffd3c5", "indicator--b5845897-60b3-4b9d-b8c3-ee1311edbd9b", "indicator--ca52b564-b361-4c17-8ad0-d6e1a56eb18b", "indicator--2d87a367-1970-47b1-9741-67ac31d7e829", "indicator--a3a1964a-1824-4140-9e33-c9877c1eaa71", "indicator--e009b558-bac9-42bd-b831-5df91e2c0d68", "indicator--6ebfa2bc-3b53-46f4-997c-f4837e978c94", "indicator--917f7d8f-12bb-4264-af6a-3304b7c5c165", "indicator--2a78f7e9-de21-41fa-a0f3-511fd96b7398", "indicator--bc7e3411-abc8-43b5-b395-7d5bb3d3925e", "indicator--b03018f3-ee7d-40c0-8fb7-7b47c9451638", "indicator--f751ae04-f32e-4477-ae65-0c5e567d4625", "indicator--4a4f6fe8-dd0f-47a8-bf74-afc32a45584b", "indicator--39830746-23a1-47cf-b799-166e88fa3dac", "indicator--d6cd52e4-9faa-425c-8bbc-6bf7a9863950", "indicator--ca0e572e-d238-4b60-8f1e-e4ef24f7a0ee", "indicator--93a83832-7378-453a-a2b5-6cad80f8903d", "indicator--f144b39d-fe43-405e-a970-38cf8caa95fa", "indicator--fd0abc86-9d16-4b99-8626-4c898ecaca6a", "indicator--99972e50-1b7a-49ec-8f3e-1ddddab8cb89", "indicator--0c90d637-7586-4bf9-8b1a-7cfab054238e", "indicator--3f266694-b8f7-4835-b33a-9ea0c0745698", "indicator--4393f5f4-caa8-42f3-bb3d-a595a39ecc9f", "indicator--2291187f-4ef6-4950-a0a5-b9b3122cc1d8", "indicator--475f3b6d-d497-4a86-b77d-9a40f1445aa4", "indicator--49078667-fc6b-4c4a-887d-7d90752ef7e4", "indicator--fd3e2970-e076-4eed-a2e4-94ff497ba704", "indicator--05c36580-94a3-41b0-81f4-c08817a8da8d", "indicator--1152bc88-a3e1-48b1-ad5c-65d57824b8d7", "indicator--5d12ff72-0506-47fb-b402-2f8438076d2f", "indicator--991d450d-b9d7-46d2-aa67-d793c8e8274f", "indicator--74b5c59e-e229-49b1-90a5-a7ced3f4521a", "indicator--14580c1e-f65b-45ad-bd9b-b15a837a6f97", "indicator--08713232-d90f-48b1-832f-bd6e6272c007", "indicator--1310ac7d-f0e0-4f3a-991c-9c6af83b3bd5", "indicator--252c55a7-3ee0-49d8-8a71-435ee448dd3f", "indicator--cfb844b0-b04f-4681-9016-91d6540c78af", "indicator--9de0e4a4-b248-47dc-bfd1-12e26332f581", "indicator--43cf773c-ae0b-4123-b257-6f6042ec57be", "indicator--ec26d7e4-a236-492f-9fb3-c8408819e3d7", "indicator--86085d22-c2de-4456-9fde-38519445afab", "indicator--d532e4bc-82d0-44d7-a783-9e3695b61498", "indicator--4cb55bf0-7939-4dd0-ac5c-8974465f2e4f", "indicator--58639c52-cde5-40b0-b1e0-1875bc6028eb", "indicator--f0e456e7-0950-4f5b-bffb-c9033bfba4ad", "indicator--d854bc78-5727-4a39-9826-48fdeee4f20d", "indicator--3a61e0c3-8dc0-42ae-929f-fa59ee50905c", "indicator--188a8333-2a8b-41ac-a150-8909f20460c5", "indicator--6ef52edc-cdbc-4f16-8b14-d787066c0a4c", "indicator--17db7ccc-d087-406a-8221-3e51c1123e53", "indicator--b8bafd12-ffb1-436e-8a04-b05d4587f30f", "indicator--3778afe9-5dd1-4c31-8ca8-654fc3efa2e3", "indicator--a437939d-04e5-4022-a16b-fcdde2b7b73e", "indicator--a08b0444-f5d4-4df5-8268-38be2cf77ea3", "indicator--32261d18-43d7-403e-a098-c1e20c091f26", "indicator--fc63c26a-7f83-46c9-bcb4-ce292cba9c14", "indicator--e93fa1c8-9291-4ec4-91fd-e8e2dcdc40fd", "indicator--c4ff0921-ced0-40f8-aeca-c446f6fd3686", "indicator--e2ee8795-7989-4802-8e28-26568b05cf05", "indicator--e96ed704-5ae7-4f76-952e-9f812759d916", "indicator--2e3f16ca-dab3-415f-94fb-bafcb861e135", "indicator--501f43fa-f3af-46d7-8fb2-960a5de4b406", "indicator--15bf7ff8-4a92-49c9-8920-6594d1b79f45", "indicator--e91ecc89-3937-48eb-b3d0-34e64baf34f6", "indicator--797c17e6-972f-41d0-ade7-bb257f54d4a7", "indicator--495c5ab2-67b6-44da-890f-2e95308f563f", "indicator--cfebb20d-0871-4aa3-99b3-76d1fc39c2df", "indicator--5adbca6c-5b1a-4388-9898-95b4dc2cdf94", "indicator--5eda7ccc-88c7-486e-8102-004e6e9c68a4", "indicator--59781518-dabc-4982-b39e-aedad27590cb", "indicator--0a64b6da-84b1-4c61-b218-56ca029eb595", "indicator--4772b219-005d-4ce3-9b46-7e92fa751aaf", "indicator--287b4429-79dc-4b76-83ec-28ad8491535c", "indicator--099bdd36-cc57-4d90-ac9b-de2b108ab996", "indicator--516ff83b-179b-4397-af34-54beda3d5d77", "indicator--9610b3cf-64cf-4f11-b42c-3b3f7a7ea638", "indicator--46cb7839-9a61-48a9-80c1-a88596f5fc3b", "indicator--bf5f9331-0df7-48b7-88ac-947fa1fb810c", "indicator--2880da3e-1c7e-4f6c-ab52-1e4109c53d08", "indicator--f53c0792-561a-4124-93dc-ca9aac7f9003", "indicator--61d40d7f-216a-40b7-92a9-f75702d58fe8", "indicator--7c33f48a-30aa-4b35-a532-1672e60c7d19", "indicator--1ff46b1c-c07e-4146-9457-7bbd23ee50c2", "indicator--7235ec2f-f22b-4843-aa8a-2b31ee5499e8", "indicator--481dcd8a-d909-49f2-aa90-ea5ea9c791ad", "indicator--926241f2-25f1-4a65-af20-08168e52984a", "indicator--af0b2f8a-fc25-4ff3-9e3c-2e25591e20ce", "indicator--60bbdfcb-0a45-4908-ad94-253163f7cba0", "indicator--c9881c25-ef89-431a-b2f7-cf9c4402a4cf", "indicator--aee72775-9960-4471-8b7d-f214e353eefb", "indicator--ae8f4d0a-672e-438c-8ddd-faa6bf5df143", "indicator--2d4bc947-488a-46b4-ab27-dd60fa16b26f", "indicator--a5e3aa3d-5c96-457e-8bf1-3146c0df1315", "indicator--bf6554b5-ec07-4ac8-88dc-a8335bd8d0a1", "indicator--29e90b2a-05ff-4aeb-8adb-a762b9560f36", "indicator--04b97c59-f709-4854-82eb-4fcb4e48243e", "indicator--c0b1293e-1e48-44ba-ba93-ab9bfd472a33", "indicator--77fd03d2-b5ee-4be7-b4ba-a0ecf45b5f15", "indicator--08798de4-274b-4065-b25c-9ae662bbc2ea", "indicator--cb6aa1d6-2672-4c2a-b32b-4a68185fe0c4", "indicator--332ea12e-4480-4582-9cb2-150e5b36471f", "indicator--94f215c1-ac46-48f0-a2c8-a3ee4461342e", "indicator--f6b6ac16-df84-4835-9dbf-4767c460c825", "indicator--ec5f2037-d807-4e06-a493-b4ba25323f8d", "indicator--3f48f473-5d65-4280-94db-8d2003323abe", "indicator--997ca7a2-8667-4659-a7b5-d1d9dc3b37ad", "indicator--4fabd90e-28e2-42df-b093-4067c96c8ea7", "indicator--4270b522-43b5-4af9-b539-4a7ed57c0418", "indicator--2ed59df9-19b8-47c3-979e-a5600928a495", "indicator--773225b1-04aa-49cc-91b5-4441f93e4a03", "indicator--e86d7c04-5847-403a-9b68-e75e7dbc85ad", "indicator--2904c27e-ab2c-4e8c-9fcc-892304548d66", "indicator--49322054-2b65-4195-a246-7e36d445ed08", "indicator--487ebe6d-558f-4013-86cd-6a9a4f849c42", "indicator--fbb5a1c4-df82-483a-8151-54bd9d79c295", "indicator--d8c9d35c-143d-4f78-8f2c-6bf2b2f2631f", "indicator--85439bce-f496-4a33-b915-797612135252", "indicator--630b59f2-6f58-438b-b15b-ad991fa3f350", "indicator--cdc07dfa-9aca-4ede-a17c-cbc96823937b", "indicator--b98d5db5-c111-4ca6-ab28-a16c8b4262d1", "indicator--0225c311-517d-4485-9277-2b04f1ea2b86", "indicator--f17a0548-4e68-4f8d-aa7e-e84969da260f", "indicator--7f4f8aee-77b6-4567-87c3-dc031a1c8fa5", "indicator--bbaea669-1c4d-46e0-929a-58cbf5c0d3dd", "indicator--ca2f4c09-a5ec-4359-bfe8-646fb00070b2", "indicator--4eacbb54-ea46-4744-b657-87a8c64f8e79", "indicator--c83b48c1-da12-42dc-a1d3-33fd6269f42f", "indicator--1f5fd468-285d-4f12-8d6a-6c9e208aaf04", "indicator--c32e1a45-1ef9-4d1b-b92a-7d6600a80821", "indicator--192fe54a-5d25-42c6-b719-b2fac9ba743d", "indicator--4cae5097-4746-4346-80df-9b7bc35d58a8", "indicator--a7f55520-9489-4512-bcaa-8af471d28e8a", "indicator--6d17b470-ef80-4167-be61-f9a3cd2645d3", "indicator--6f696805-1b73-4fa2-a165-0fac91d04d64", "indicator--d77ea09a-3407-4730-9381-c356151cbc19", "indicator--3f1d6421-d07f-4397-bb28-9cf378707e4c", "indicator--3ffcaf17-462c-45f3-b324-bfb7181353b6", "indicator--86887400-f2f9-4635-b31f-fbe41893c791", "indicator--e3478ee4-566c-4dde-a10c-881130c90fc0", "indicator--e1681c46-e098-4924-a04e-1bd561c1ef34", "indicator--cfc65e58-22a5-42c3-9340-f84addfd79b6", "indicator--2d7bd613-edc8-4dfe-ae2f-0820f9836e3c", "indicator--e8e8d034-78bb-4838-8201-bf999e459094", "indicator--d4c1f99f-871a-42e8-901d-668976ff7920", "indicator--1778f7fa-72b7-464d-90da-64c2f626c377", "indicator--00e2802b-f371-4359-89e3-c370afade937", "indicator--f0871e25-fd77-4f5b-bc25-aa0c858ded05", "indicator--e812ad39-623f-434e-82e8-e257a2b871f6", "indicator--4d039d04-454f-43f1-b571-f7cd70ff2a15", "indicator--94ad3607-399d-4590-aaa6-ceb59ff3e5c7", "indicator--3f9acbf6-b168-425f-8422-bc74ec45375d", "indicator--8afa4e86-3ffb-4c91-81aa-e2b4242e8656", "indicator--048926a9-dc57-4be8-8e71-f08a06d327b1", "indicator--6af677b9-e912-455a-a355-feffc423e096", "indicator--69810b6a-1fe0-43f7-82e8-3980b5ee25c2", "indicator--24e87406-ddcb-40f7-945d-45b1cb3f9f8c", "indicator--e5375661-5544-433b-8c9f-20e6b1de63fc", "indicator--998e56db-9fb7-417a-9074-9025835b8d02", "indicator--651986c8-1c34-4611-bf67-db5eac9abdf8", "indicator--b39070b0-2b14-4d25-b87e-c2cd0de05f79", "indicator--5488ecd8-29d2-4cef-8abe-ca962e9558a4", "indicator--5f4b1d19-e682-4e31-9c7f-7e2694b6aadc", "indicator--95b01cfb-d366-474b-8413-6e8b1b6a2e1c", "indicator--60797665-79b3-42e4-bc0c-5b486e1a9c19", "indicator--6119a3fe-f1b8-4d04-898c-6fa5a8cfaf85", "indicator--9a772364-0ba1-4388-b149-924d81a6e0cc", "indicator--5f8658e6-3cc1-49b1-aa1f-8fd7b44f6ffe", "indicator--f8080669-915d-416a-a2e4-df6c3956c30b", "indicator--fc92b175-23b0-438c-92cf-d2a279180da7", "indicator--9d7d5fcb-a9ee-464c-9634-9c155a5b264a", "indicator--e5207d12-a28f-4313-86ed-272ffbca2207", "indicator--27e9bf2e-fd1a-4671-8df9-2b4f66257441", "indicator--78bd5768-3c6d-43fe-93b6-155e3d7766c4", "indicator--61febadb-0a64-46a5-b1bd-c8077eeeff3b", "indicator--0b41a12b-1937-41c4-a052-53d663636a59", "indicator--153a2d9f-5e89-43ef-ba6a-02555e8b82d6", "indicator--ce41a5ce-6e83-40fe-aca5-31e3ba7a2ddc", "indicator--42f4398a-7735-4898-9825-30a0f3ff1ee4", "indicator--3a05caec-8e21-400f-a05b-372bdc2566a2", "indicator--7ef33f84-f950-4359-8104-61268394228f", "indicator--e6cbf10a-5b05-4a51-bb70-ab8d85c2f93b", "indicator--7b3e84dc-8c48-4763-bf99-e305e61d7eef", "indicator--e6fee3f4-31b4-42c6-807a-343d93288172", "indicator--ac64817c-7c3d-47cf-8096-da5f6f4bb5ac", "indicator--94cf3b1a-7312-480b-8419-a83b28ec3040", "indicator--cd2d8497-136f-4342-88a7-e0d968a06f1f", "indicator--4f8f0c8a-aee9-4d2f-91ff-9960f297df2a", "indicator--a8df8932-7a71-4735-823b-d7368a67dcf9", "indicator--192ae0f5-87da-4443-9da8-203e5a977a96", "indicator--b85a48b9-276e-4d12-ba91-27756b33de68", "indicator--8457a39a-d59c-41bf-8f97-b4490d2091cd", "indicator--9f38462c-6316-4022-ae25-45c53d774dcd", "indicator--bfe61eba-8e97-44fd-a78d-f22c23274ee5", "indicator--54fcb37a-1b74-487e-ae3a-51df86406ed1", "indicator--ab7ff8b0-bb1d-4612-aa2d-107994056614", "indicator--e83a88df-d3ca-49f3-a4a0-8fc4bdbdf682", "indicator--ba0570a8-220c-4245-98e8-ab54e3cf020c", "indicator--8acb0daf-1e40-466c-87c7-3521284a53e1", "indicator--a3e1505f-3a9c-4dbc-8e72-ee95834210a3", "indicator--ce042a64-1732-410c-9f52-fe1afc785327", "indicator--eb3f5161-48ce-4f43-8632-5c6c603a9b25", "indicator--7ea5794f-d88a-42fb-82d5-8a05e6093061", "indicator--c90ecf3b-77ab-4695-91d0-58be2eb5f2dc", "indicator--29508f0f-c100-40de-a172-6e6576041c8f", "indicator--9f460163-de10-43fe-927a-70e45238aa5b", "indicator--8a703300-483e-488f-a718-be2166ddef4b", "indicator--ef6e4e85-1dee-42fa-9ed5-2798d607ce7b", "indicator--c6c1fcd5-f687-498a-aa0d-ac1f1d26e31b", "indicator--b1c2fdec-5bda-41f1-a321-5155ce8148b1", "indicator--89bed5f9-4192-4004-981c-0f5e87076bf1", "indicator--5ee424b0-88be-4f8e-8705-bfc32453e7a3", "indicator--7f1f64c3-93f2-4d7d-bbc3-8968b08dc8c2", "indicator--ca8a8cf9-04c5-4d1e-b2bb-71d35b796266", "indicator--b2b5cda7-3a37-43eb-b2c9-c30c026371e2", "indicator--8cbef57e-702b-4ee2-bc26-4733dab74353", "indicator--8645ca66-9ea9-448c-8031-5f1f74407486", "indicator--8b68674b-61fb-46e4-b18f-965a26deb3c5", "indicator--62bcb09b-6bea-4c66-92d3-0276df8e60a7", "indicator--4f4e6b5a-19f5-4de5-aef0-7789c1ebf41d", "indicator--61a95113-5da5-467b-ad8c-8aa8baf66333", "indicator--ab790848-65ed-45b5-8578-11847d1d35b2", "indicator--6388d07c-9a39-4e2b-836d-24d543da38d9", "indicator--d3bbc9ca-a7ec-46fb-b1e0-d78c29cdd5f2", "indicator--17709478-f098-42e8-8f33-a88d760412ce", "indicator--1ade2284-9b5f-4311-94ca-149222d7cd0e", "indicator--b2bced52-0b13-4db3-9dd7-b2503bc9c50d", "indicator--dd99f6a8-b9da-43a8-9229-5b7f42d00d9d", "indicator--0f6a7e06-ab1b-43ac-9ac9-163267d04988", "indicator--ccbce877-4895-4aaa-9516-b201d3511ea5", "indicator--89183129-2e4f-430e-b5cb-8d053d5e2e7a", "indicator--5b2f4734-9d51-415c-878a-da0a825e419f", "indicator--5ac4425c-be9b-4375-812d-615c064350e5", "indicator--d19322e4-3e64-4d7a-b73b-587e2ca74be0", "indicator--d1a25654-0f72-4a3a-b30a-b2144351ea34", "indicator--83f95abd-c494-4891-b7fc-391aee505de5", "indicator--7dcfe364-c59d-400f-ae22-f1879191f2a5", "indicator--ef15f606-a70e-4260-b316-d366ad6c26ed", "indicator--29bc38e2-d2cb-4ce9-864c-2677fc780475", "indicator--4c0ac34f-58a2-4d2a-9500-2f70f963de92", "indicator--b5aa93f5-2a3c-4eb0-b707-150db758bd41", "indicator--7e19cfde-ebf9-424e-a0e4-eb8f79af2f1e", "indicator--9911486c-3d1c-4722-9555-0a07687ae254", "indicator--ec4a21f6-0da4-4004-a516-9882b85e755a", "indicator--a884058e-eaeb-4c8b-989a-7d13d7674d2f", "indicator--bdf7fbe6-1840-4a69-adc4-82a50c9f91ab", "indicator--cd8957ab-1ccd-4d21-80da-ebacd511624c", "indicator--f4225f20-6979-42ee-a6a9-64fc67e28ec6", "indicator--779edc97-955d-4d4f-af9e-04afe813eb8e", "indicator--a4822f15-6f83-49b0-8dfb-41df769c2102", "indicator--0391de28-a8ff-495c-88a5-db0132e52434", "indicator--267ce3a9-83f1-49d6-8777-e767d22a951e", "indicator--9b87a4cb-7cfc-40be-b2fa-fd221fe9ccee", "indicator--734d556b-8e4e-4cde-a58c-3c77c6d0475f", "indicator--adab0738-3e4e-4650-80ca-b035cda88252", "indicator--ee48b32d-4e6a-49f9-b07d-e7d2ed24e9f3", "indicator--4ccc02bb-8dea-4ede-b56b-e8f3d5777472", "indicator--0fd0bdb7-f444-4374-93c0-a17012d80168", "indicator--35e30e53-24ef-4336-b407-74c0b976f19a", "indicator--439eef4b-e066-45e9-8b25-4a8e850aafb2", "indicator--66bd4f51-95ca-42b0-b758-f91331a57537", "indicator--6f4b261d-af39-45db-8745-ed2ce329d15c", "indicator--798ad6fb-5c35-4975-b0e1-948861f0d6cb", "indicator--ad791280-14b5-42ea-9a66-00218fe9671a", "indicator--e04597de-47b5-47f0-b34b-c07a4771c17d", "indicator--1dc87efd-343a-444f-a566-973b6eb13cb6", "indicator--7e3cc8f5-85a1-4501-8f01-56c74f79ccd4", "indicator--dd83fa24-6cfe-45da-bbd3-e2e86ba5e3c6", "indicator--aa7d7aff-e201-4118-aa24-2df9162a71d7", "indicator--14576803-d759-496f-a0c5-1d7e4cd021e1", "indicator--d34bb329-1bd4-4b15-8de9-f0feb307aff4", "indicator--5bb43a57-e6fe-482a-b73d-63f75bc52f1a", "indicator--65bbe776-f49a-43e7-9ea1-28588f204bb0", "indicator--a7988d4d-f228-4579-a6b5-4f84e45cf14b", "indicator--82613d4f-1f49-4bf4-a1a6-e7452b14f109", "indicator--9ca4d186-3234-404c-8525-b5607e5574cf", "indicator--954262a7-84b7-43a2-abaa-73d9ecebb270", "indicator--6ede2c2b-ab87-449b-bdc1-e2915e307357", "indicator--8d999288-c975-4d32-99fc-c384a6bec229", "indicator--7e99768e-0653-4d98-a554-59d7aa5ef99f", "indicator--76e46e77-90d5-403d-b468-127c36d46236", "indicator--7f11f8c2-35cc-4e46-af5a-b5e62d56b91d", "indicator--a9d2b7f5-5938-42ea-bd6f-9a744049af39", "indicator--1cfa585b-321b-4af2-ab7e-df81edbb1dd1", "indicator--b36f8f84-f663-426c-a31a-536c4f259f69", "indicator--d126baaf-4781-4d65-ae1a-104efcb732bc", "indicator--6cb6c975-4db8-4a4e-8034-7d926396fc3f", "indicator--f0c7d2eb-1eda-429e-9c1f-e258a18830bc", "indicator--bbe8a3a7-9084-4f98-8d27-8aab28cf30b8", "indicator--ca47c1e2-38d7-4263-a241-97dc9c5aedfa", "indicator--4b1c70bd-9e42-4655-857e-2afa639272bf", "indicator--4d50afbd-b550-4f1f-ac4e-a61f66672ea4", "indicator--7a429d03-0b29-438e-84fe-e84479d34c3e", "indicator--3e3cc3b6-26c2-49c0-a29f-9ddfae5ec3ff", "indicator--e1e0b10a-b0fa-482c-b0d9-82767cca3e03", "indicator--a476f6f0-0b7f-445c-b06b-8801736dbda1", "indicator--61bfb8e6-2070-4f2d-8662-cd953c211dae", "indicator--200f3ae3-d9d3-4aea-aa74-a567feb1d634", "indicator--f4c56c55-3311-412a-98a4-7d73baea43ac", "indicator--3be5cecb-bc00-4187-950a-82dfa93d0f6d", "indicator--10c5ccbd-548b-4130-8d6c-ce17f9c11d47", "indicator--ce00181e-87f1-4e91-964a-e139e3710fe4", "indicator--6a7eccad-7cf6-46d4-b000-6e01b061e07c", "indicator--6ddf6b86-459d-42a8-bff5-3ebfa8cb398e", "indicator--915a4e7b-dcdd-4da9-b2e9-bf84421ef0a2", "indicator--eb21b649-a7b8-48bb-9232-8f5f03ea6e07", "indicator--931b8026-0d20-44a0-9c8f-87ae50ce613a", "indicator--5d7ecbf7-1b51-446d-b754-be3e2835ade4", "indicator--e9b5bbfa-4018-4a96-9903-888043d95c33", "indicator--3eeec22f-a82b-4d29-9ee3-cd949008603a", "indicator--4c256511-fa23-4347-b1b8-48ebba1d95ed", "indicator--471853e0-8ef1-4964-ab50-ddde93b37e08", "indicator--60a615d6-4f8a-42d4-b99d-4178a46ab336", "indicator--265b1885-e40c-4081-91c5-b69993e92f0b", "indicator--b25eb756-ccb9-44f6-9d47-55cb248c59f5", "indicator--d4375773-6c2e-4d39-a4dd-390d791970d5", "indicator--ee488c39-c694-4651-9611-3ccd1690a3dd", "indicator--e49afb15-e5de-4f2d-8483-9e0ea68693bc", "indicator--f5445324-d4ed-4ce2-ad80-5dc087337cd8", "indicator--60eb5c03-e3b8-4f60-86c5-d0ada6626f31", "indicator--9c8e215f-51da-44cf-8cc1-56590fbaf4d1", "indicator--9aa21bd5-052e-49e0-bd23-f193b060f88a", "indicator--4d7718c3-dd52-427e-b84a-072b0f1b903b", "indicator--ebe51895-2cf8-444f-8537-a3f9da8dac4b", "indicator--5f268aa0-b560-4bcc-bdcf-2a093d8b0379", "indicator--22d75418-ce2a-49b0-9901-4e0e1ab40d09", "indicator--8e161f4b-7578-4816-9423-3fd292385516", "indicator--81892b3f-71e1-4c21-949d-a1a47c01d1ae", "indicator--aabafc9f-5326-4724-9661-ade18a636e23", "indicator--ccbe9c8a-6192-476e-8bd9-e56ed8d29d10", "indicator--fa05d5c8-75d3-419e-90a4-743f727e9cb8", "indicator--4131ddb7-1d19-4996-962d-a48c4bf76350", "indicator--d605cd47-cb52-483f-aa0b-79788f63016a", "indicator--4f72bb79-e95f-4e16-b918-fa61ebace168", "indicator--76304ec7-ce4a-4a9b-a4c7-c491d916c7ef", "indicator--538a1e88-fd78-4f20-aa3a-35116e075118", "indicator--25a1777a-3f75-409d-8a73-62084030117a", "indicator--17dd7f64-0527-4c63-8a58-2a3d0e6ffede", "indicator--88b9ab2c-b263-4bf9-8ddd-f481bec676e1", "indicator--99ff9277-9a92-4bf9-a6f8-9386e426cfe3", "indicator--59c111d3-b71d-40e1-91fc-09ed6a84b3c1", "indicator--9252202e-27e4-4a92-a395-cc56445ef4cd", "indicator--024da3a7-712f-4cdf-8992-638281a3ec0d", "indicator--31c11d20-6927-43ae-a976-e96a7490d58d", "indicator--c14337f7-9246-43a1-bb21-bfc4196d92be", "indicator--8bd686b1-4c82-4c37-bcaf-809c89cfd4b5", "indicator--9b10814f-ba8a-4cbb-ad54-ca0820e9ffb7", "indicator--92938da9-c1b8-4803-8f6d-1b41756da574", "indicator--14d1da2c-1eff-46c2-a040-e7b35a29f3ce", "indicator--469a544f-f0d8-4fa6-ad4f-11b9958098d3", "indicator--e432c6b2-8c39-411d-b211-b5b19054195f", "indicator--2061ca57-bb6f-4342-a5cf-2533b0dec6b6", "indicator--1fb45842-a5b2-44d6-8ed3-018e39150d8a", "indicator--3d2781f0-354b-4d9b-a9ad-3e5be295d94f", "indicator--cdd18eac-755f-400f-b0af-c73cc4e30688", "indicator--0e73920e-e125-40e4-90f2-f7ec8d38448c", "indicator--1754a0b3-8bb4-464a-bc72-20d31137662b", "indicator--6f3c18a8-aeb2-4a16-81d3-e7803842ddae", "indicator--40a42462-a98f-469b-9fab-5c21c0075841", "indicator--ba9dcc80-099f-43cb-92f4-8d6f4f28e1d9", "indicator--28c2127c-1f5c-405f-a4bf-47dae713ab11", "indicator--4df79293-5479-478e-b587-64090f85de03", "indicator--ee0155d3-76b2-4103-bffc-52863d92925f", "indicator--1a75ed65-4475-446d-b72b-09688d4d59dc", "indicator--dd98c88e-425f-4ac9-b203-0450db7f0cc9", "indicator--743a3b69-35a2-4ddc-8e07-c5b6c3da95bd", "indicator--e147dfdd-6f6b-49ff-8e15-9c9bbf10c804", "indicator--e72a99ec-8345-43cf-9ee5-75d5a0303d8b", "indicator--ee308c71-94de-4fcd-b205-31f65a1e9228", "indicator--5b4dc204-8752-4085-b3b8-90bacdfe6753", "indicator--6115ae76-fbfa-4502-a3cf-6796314b3c27", "indicator--07d01e43-ddc6-4c77-b8f3-7e66b04233aa", "indicator--8eaa5971-e73a-4f9b-877d-5d99f0052202", "indicator--3c8dd546-e770-43ba-91df-958ff8c1a742", "indicator--5b2dfa4f-4826-42ea-a1ac-666c7b7704b1", "indicator--f29954cd-ba73-49b8-9deb-959f9420fa8e", "indicator--81794924-431a-4070-a2d5-4394d8959da0", "indicator--f1a232b0-5e44-44cf-b9f6-0dd7d78894ba", "indicator--55294db6-02b8-4f7d-b366-35f08530c233", "indicator--dcf2122d-10ed-4ae7-95aa-506ee8db50c6", "indicator--836747cf-84d0-4007-b81b-f6e09c6c5640", "indicator--70436c60-a6db-447c-b7f0-40353be35cbc", "indicator--6182bc7e-4e4c-4cd3-a18d-e40cefcf3e46", "indicator--b3d7fce1-62db-4f0e-a7fc-d57013bb7272", "indicator--dbda1ba3-262d-4002-a89c-11d9ca10a8c3", "indicator--b57af03c-bab9-4859-b538-67491a68f55b", "indicator--224e9f78-b323-483c-89ef-6b345edf770e", "indicator--36d9a322-082e-4740-ac17-bec307c4284e", "indicator--952da9dc-96e1-4a70-821b-e94df9691683", "indicator--c8ce1e43-ae69-46a3-b11e-3af36f5b32a1", "indicator--30e70771-f6fd-45da-a8ff-8f6a880f2943", "indicator--d6789107-c0ed-48cc-8691-f290d2965225", "indicator--867b7911-2cd5-4dc2-9e99-0e858479c4c5", "indicator--a17230af-3188-4a47-a41d-7a3c15c49707", "indicator--5ff25973-13aa-4f71-b8a4-0c14c5761904", "indicator--4a758c7c-9a13-4be7-924a-22d7d8848ab1", "indicator--7d88d000-e5cb-40ce-90cf-0640d85e01ed", "indicator--80cac1d0-1fcc-4f06-8b6b-8a5e80d9792b", "indicator--6cdc88a9-22ed-4afe-80f6-e18fb3377f43", "indicator--b52687b6-1704-4f65-90f9-069b61c94b9d", "indicator--5d969ef0-2a07-470e-8258-a0a1780fbfbe", "indicator--d97e5012-c509-4705-9a43-3bdb046c6f14", "indicator--505de3eb-b233-4059-a4dd-27752039742a", "indicator--442ca244-8dd0-4782-ac03-bc1bfe81922c", "indicator--0b2bca7e-d385-4f08-9d2e-51dc1ddc8bd2", "indicator--8f22ce72-2f06-4601-b21d-eec41f64421b", "indicator--89bf2572-66ea-4586-a311-cd4bbc249a28", "indicator--ec2c2fda-44f4-48ed-b6bc-d01e3f4aa85b", "indicator--6205fd59-0da8-48c0-920e-c22879b9c433", "indicator--ac44754e-e6b3-4731-8595-36c7bbd20b56", "indicator--3eacd8dc-e4d7-4ac3-bce8-d172df2f8925", "indicator--9e996ff6-f2d3-4133-af57-f44059081e28", "indicator--19174e8c-6522-4386-8838-e3ae2300ee4b", "indicator--133a6e1d-eb2f-4cdb-8691-35a61fc6c191", "indicator--b8a7be94-64db-4952-a010-a48bd1527421", "indicator--942d159c-625f-4b2f-8779-f93005d6d95c", "indicator--8aada716-f625-4379-b62e-8ab48b327b7f", "indicator--1ea03b9d-8a8b-48ad-82d1-d8886010e322", "indicator--f4a4164e-8f04-4461-a64c-fd72d0916490", "indicator--b4c30776-00fc-4cd9-bc7a-9b02fc7773f5", "indicator--a53ea11f-361e-4dfd-90be-5edf4d8e6d44", "indicator--1cbd5cc5-4ca4-463d-9855-7274eabeadb2", "indicator--3d3a3608-9051-436d-b4b9-987b7930c540", "indicator--aee10bea-c48f-40bb-b870-566a975b4dad", "indicator--cbd97549-ed9d-44a3-afd9-243e7138ab9e", "indicator--e3fdaeb1-9b8a-4ca9-8aba-f11918d8f6a2", "indicator--4a7e0d27-5396-4225-bc4d-ef71693ab32c", "indicator--13ebfe83-8679-4af3-8d34-6bb43a9b2ac0", "indicator--652d4839-c7ee-4617-a836-a31274e34779", "indicator--31959d21-cd7c-4038-82f6-df697c80e5a1", "indicator--67c73a33-e4fc-40bc-8cad-45bb8b0a405f", "indicator--21ebf07a-4385-4e9c-9ac2-8c60056ded37", "indicator--d732bb29-9081-4b97-9d69-fed2382dc125", "indicator--932216b2-c77a-4d18-95c6-e322a6c5863f", "indicator--3aa44c85-cfd0-4187-8f9a-17b43272213d", "indicator--64aeb511-9eb9-4d79-b7ce-71e083674aa9", "indicator--98f63de0-59a7-4161-83a6-bd434e80b350", "indicator--0648c262-9556-4233-98e1-0ae85169493d", "indicator--a3c4f388-75a0-4fd5-b823-18429d2bcd93", "indicator--3ed6bdf8-96f8-4c6f-9a08-4f28747ca2be", "indicator--3e615c7f-436d-4335-9b98-c6beab703239", "indicator--79ff1dd5-471c-4c84-b17f-5a4fa3a0c6ba", "indicator--2156a569-9174-4e28-82d6-7c5a2352150d", "indicator--25c948b1-9371-46c3-b1c9-7f88107f0cef", "indicator--9c31395e-8b83-4209-a6f6-784282912f0f", "indicator--51043921-cc58-45d3-979f-7c8d391d2110", "indicator--afe89360-c253-4306-88b6-3d1f18c1bfc4", "indicator--af596983-51df-4d8a-a4b8-2633e25ca9b1", "indicator--3f2a99b2-0e34-4291-9a83-29e44f91443f", "indicator--b7cb1bb7-66be-42c9-906b-93275089717c", "indicator--c074c711-c1b0-4927-9473-0fb5fd8f41bb", "indicator--b5da8f85-afb7-462b-8caf-e75289401278", "indicator--1b4509b1-fd59-4e91-8375-01ff4127836e", "indicator--7386a67d-291e-441b-973a-79dcdd79f860", "indicator--4afd5ec3-a568-4284-add7-b557923ecca5", "indicator--39ffd6fd-d757-4ac5-b915-9aab7afb51a7", "indicator--fc579aa1-d648-47ce-9504-848c9b60f8eb", "indicator--e0f543fc-1f1e-4e18-8cea-2ab412ed64eb", "indicator--c6d450fa-0751-46c9-8d39-885912edfbfa", "indicator--fd5b1c84-7577-4dbd-8a13-bce1e078d7b6", "indicator--f93ff5e5-2b2a-427c-aafa-8aba877a6c95", "indicator--e45e42ca-27cb-4997-aefc-501610faf764", "indicator--f57e1028-1669-4723-bb32-7bc8f0b2dde0", "indicator--188fbe55-9004-492e-8170-af76e4c6e18c", "indicator--a5617d4b-43c2-407b-a222-7824976cb1a6", "indicator--2fce43e3-7735-49ed-972a-d6fc1c74af84", "indicator--9cf60c68-4210-43e1-810b-09458014f2fe", "indicator--01644201-5b15-4a00-be37-c3840a804209", "indicator--b7872b1b-5385-4873-b2f7-d337cd2dee69", "indicator--ff4ebc78-c9f0-46ba-9c91-767f692bd783", "indicator--5e0d61c6-2bd4-4f9d-bf09-6dd4e438f5f4", "indicator--b9fca2b0-84d4-4c9c-8b3b-1dd87ab9bd62", "indicator--c48f78a4-e5e3-4da0-a986-4dda67eab0de", "indicator--91b79aa1-d429-458f-b06f-c03516712eca", "indicator--1b26c99b-b995-4328-bbc2-3ae5ed020fa4", "indicator--a6cf857b-4792-4a47-a6cb-abaaa48aaee1", "indicator--2b716fbf-eb03-4863-ab58-fa80a933255e", "indicator--85e1bade-3bef-4b88-bd67-4f0efb8290d7", "indicator--4bc01751-3fe4-4c97-a8ac-e022fafd05c7", "indicator--99d17507-eaca-4f01-b6fc-f840004ec010", "indicator--e2731b9a-6ab2-4b12-a4d0-012695852db2", "indicator--bb74b31f-9b56-433c-9724-834308f2f0ca", "indicator--ce9738ad-ae66-43d7-828a-06e9a5d71d55", "indicator--59c544f2-1950-41a3-8432-b8b12c604a2d", "indicator--c6173a51-6fbb-4587-9929-79d54d4a362c", "indicator--6b703334-06e1-4edc-a114-a45d005e5b5d", "indicator--447cd953-8976-43da-82c9-75351dcea670", "indicator--595de877-702a-4e35-9b3e-aaeeef12bc6b", "indicator--e13448a3-906c-45ae-a859-40ffe552e958", "indicator--708ca607-bd57-4e47-b5be-ba8b26a6ff69", "indicator--79b8183b-f2fb-41b7-8a73-2f01ef57fc64", "indicator--2e72a5e5-0b59-40ae-9e12-de6fdb2fe7e5", "indicator--f7a82141-2041-4f4a-9d61-5c20cc271bdf", "indicator--601160bf-66f6-4911-8628-5d544ca7d636", "indicator--8307aaf5-8af3-4321-9bbc-b977c0103b42", "indicator--02f4a236-c0f1-4d81-8cee-58acbd0727bd", "indicator--5794cf87-7b4e-439c-ab82-59bff4e6ce6e", "indicator--0a41cbb6-dd6b-4c3a-8849-671ee8afe320", "indicator--5ac7521d-4775-496f-889a-1ad8c5d84aef", "indicator--57207e62-a36d-4979-9e3c-2de20f73ca90", "indicator--5658fdd2-6a41-4625-a8f0-5f0c39f7c4d6", "indicator--b76bfca2-882d-48c4-9df2-c6baab612ba3", "indicator--a9be6cd2-295d-45b4-85fe-fb236959247b", "indicator--2e3fd61a-46bb-4aaf-a985-833fe921d9c4", "indicator--3908264f-31c9-4449-8918-352c0e03b1eb", "indicator--684463e8-237c-4f2f-be2e-c57fefb848a2", "indicator--760b2c21-147d-4f9f-858f-10a7c724cb04", "indicator--7bdf10f7-8d97-4428-998f-ef8699652efb", "indicator--ba2e87c6-0f15-43ff-b6a2-db791a9a2d86", "indicator--fca12c00-50e2-4f40-b080-b78856a1e5b5", "indicator--3c43c05a-cac2-49f2-95c9-ca77f5c45b89", "indicator--71168f56-c5dc-421f-a3d5-ce12284066d8", "indicator--2edebc2a-6e1c-4de9-ae9c-871cd4f3c751", "indicator--c5fa65a2-769a-4ee2-bd93-fd2018edeebe", "indicator--95cb27a5-6102-49ee-8e39-edc47632fed1", "indicator--7ff70d0e-e6fe-4981-8beb-4b39b75c5f2a", "indicator--265def3a-894b-4dc4-8a0a-f872420c2a39", "indicator--162bb02c-7f72-40ce-9925-68e8d69354a6", "indicator--45956697-0644-4a7d-b802-0d125cb470d8", "indicator--d3a5c8e5-e481-496b-9011-dd714f48aabe", "indicator--75098ab1-8c3c-43ba-9aa0-5ea7b7325789", "indicator--103a6800-d3aa-4fc2-98a0-36ffe182d311", "indicator--49b814c2-12b8-4fb9-ba18-b090fb95a9d1", "indicator--f201b28b-6c87-4554-8b4b-462ff743331d", "indicator--4cab6e12-3a6a-4966-9ad9-713817d7134c", "indicator--31cf870a-3e13-4bc2-81d0-75756e6bf083", "indicator--53d1ee96-9d90-4da5-923a-94ea38cd1959", "indicator--ab9890eb-bb62-4d2b-892d-a50560276fe3", "indicator--a908a25e-3f21-473d-8999-30676c7e4b91", "indicator--26533069-763a-447d-8a0c-eb574150c657", "indicator--08ebf3e7-fe0f-4f5f-acf9-4d088a0cc63b", "indicator--f1e99c7e-47c1-4ba9-a78b-25c61cf6cb83", "indicator--a5ecb944-a9cb-4fb2-80fa-0480b50095e1", "indicator--7c1f08c0-ad56-41b8-8a1e-9c1fedd6c824", "indicator--5ed1274b-df27-4899-8b08-c92f526a2a8a", "indicator--2946127e-43d9-4b80-aff1-be6aa86e995c", "indicator--55fdcb5c-0b34-4d6e-be8b-b94c6389da3d", "indicator--ba75d95a-1d1b-457b-b364-a8451568f21a", "indicator--2184bdea-251b-4f7b-af07-58e37bc4d16d", "indicator--09f6305b-8935-40ce-9724-826d95a7cc9f", "indicator--08d1795e-8ff6-4635-8b36-793c2a3f801e", "indicator--51352634-0cdd-48d3-8f45-a776e77d34dc", "indicator--3da8b0a6-d815-4317-81e3-c7db41150c24", "indicator--8e5e20a4-056b-443f-92c1-0f9a10ad906e", "indicator--8099e89f-3b9e-4cc0-890c-bdbcfbd588d9", "indicator--92c96067-1ed9-4122-b8c7-e87e33cac97d", "indicator--04609238-aa44-473e-933d-ebef6f6e4111", "indicator--a404da52-9e61-4b30-b832-b975d8d2932e", "indicator--29e337a6-49c7-45cf-8e36-7056c745a245", "indicator--99139760-42f5-46c3-9536-91ea6c415bf5", "indicator--70d43237-9360-4c3f-b063-a8f089249ed8", "indicator--470f74dd-751a-4aa5-883b-8b55e1c5b0a2", "indicator--1bec9308-fe24-4b1b-a4e7-85383bf6b091", "indicator--75a27cf5-7db0-4dda-a5dc-a771a3a7e714", "indicator--30aea0e0-7efd-4988-a742-ca47023af04d", "indicator--68e3b520-2601-4a3c-a8f6-40952fbc4a77", "indicator--11399f88-8f3b-4ed7-a473-171552ddf656", "indicator--b2a65fe9-25bf-4422-b9a2-ee503104985c", "indicator--9233dff7-84ed-4286-bd0b-6bfceeea55d5", "indicator--54ac013a-3cff-4d16-9d23-73dd34219a87", "indicator--ec6697c9-b850-45e9-a173-40ac03e50bfc", "indicator--f57e7a05-d6ff-4d95-a1ff-c9ced9e8d45a", "indicator--ffe14fe9-9718-4f86-add2-afffa5535c94", "indicator--76097a75-8a4d-4f19-ae98-762394ccdc2c", "indicator--cf9fe11d-e348-40fb-8b67-d7bc25a33fd9", "indicator--e06f3e34-bfdd-4ceb-8879-5cf7b44827d9", "indicator--08fd0e5f-92f4-4f18-8a4d-2777eddefea9", "indicator--e3a27cf3-9e1b-4cda-9321-3c839a98e2bb", "indicator--6c237045-1f92-4c8e-b065-c76d8001919c", "indicator--7d12d45e-1c8f-4e46-abfc-612bd0553d46", "indicator--9b7a22d6-c2cc-41e7-9720-89044ca3e0b5", "indicator--8c163643-df1a-44fe-bebe-4a7abe53bcc5", "indicator--400de7a5-9a62-4a30-a2d2-5c342db71660", "indicator--32d61a2d-1c0c-480e-bcec-520f331a7e32", "indicator--00495f08-a8b0-47e1-91b1-c74e6ef3d4ed", "indicator--ba734a18-53f3-427f-9baa-42f13d7b5ed9", "indicator--d8748dae-61d8-40e5-96bf-4cdd6445273a", "indicator--d5f4c064-9de2-4b97-856a-b4ac79cb37ab", "indicator--3f4aa4b3-194a-411c-be9c-dfb0a173d50d", "indicator--5e46c048-e1e7-4165-aa03-759278aa5f18", "indicator--1868720e-d1ff-47cc-99b5-17aeb32d7423", "indicator--09e0b591-ff03-4909-b7db-db91ee5495ad", "indicator--61a656a3-5ad7-410a-98f7-f20cc3c42d31", "indicator--7c693e50-3748-4d22-aaee-38147331a454", "indicator--b8b71201-4734-4273-9d2a-df2ff5975348", "indicator--4f89a6d9-9952-4e4d-bd49-fd65e7dc4bb5", "indicator--81e595f3-1605-41e4-9a8e-44b42680d299", "indicator--06b3d916-0550-49a1-938b-771808335e7c", "indicator--f1a4d79e-1a72-4423-a6d1-1e56a0c9790d", "indicator--e1bba601-2540-4739-81ee-b20d5fbd7324", "indicator--fe8ae3b2-bf15-4eb2-be19-1bf4ded41d15", "indicator--66c38275-973f-4772-932a-f2e4d7c8e813", "indicator--451572af-645c-44b4-8ab0-dd67b3fd39f2", "indicator--c2747714-774a-4c33-834f-0e1f817b6d20", "indicator--b5c36ee9-eadd-4e65-bd7c-78a5d05b349a", "indicator--4bfd11d6-2a2b-4e7f-a92b-4dff323ef3bf", "indicator--f735b2d0-e4d6-4da6-8568-0db5388bb5a7", "indicator--3f004378-486e-45f8-922f-de92bc6a2755", "indicator--b51093e1-07c6-4b43-b2fc-ab4c3f7f00e0", "indicator--7721272a-3a95-433b-ade2-5cf94855b5c2", "indicator--aa29fcfb-2dd3-4de0-ae7e-cfd0802d6b34", "indicator--f7e2d7d3-15e7-4dec-b0c0-eb58d7818467", "indicator--27a7f8d6-6986-4433-9f13-7a0d53b64ae5", "indicator--4d457c9d-8b00-4b0f-80d4-6a7baa27eb7b", "indicator--1df02a47-8ee8-427d-9768-1360d290261c", "indicator--874a1c99-821c-4461-936d-dd913f48c927", "indicator--5876851e-a428-4eeb-818f-c74a88a20888", "indicator--717d0d8e-4069-492d-8e86-649f0feee69a", "indicator--fc3060a1-eb0d-41f0-9902-96f609d9b4b4", "indicator--3aac52e3-13b3-41a5-9130-68c414af2f6d", "indicator--f3504109-ad26-476d-8e17-761bda99ad1d", "indicator--98d43f90-b8a8-4103-96c8-9ca061a2ded0", "indicator--12843008-1f4d-4ac1-bd96-31f1bfac05a1", "indicator--bb0735ef-4fd9-497a-85d0-e226546b946d", "indicator--2fd3aa56-da98-4813-a138-f887095bb9c4", "indicator--46bf6893-79fd-4cc1-ab59-b358aa520219", "indicator--d4d75952-ecb7-4c43-9233-635c672d95d6", "indicator--9e10d716-cc60-4e3d-9b81-61b88df26691", "indicator--d461defa-4bd9-465b-966a-d5f552960f4e", "indicator--0094b14b-6370-4bff-81b8-282e05236d7e", "indicator--2de06874-a169-48bb-9257-504b73126737", "indicator--03a571ca-f79f-4517-a16a-0595ac5fc92f", "indicator--3ae9a950-5285-4fd5-8820-b07acc731f2e", "indicator--8e783fdc-0ce8-41fb-bb63-9b661b80ae98", "indicator--6c1ceecc-db8c-46b0-846e-adc9b9a704ab", "indicator--f202469a-ce1d-4e98-8ad9-5b8d10dbc6e3", "indicator--7d5b47eb-481d-464b-b22b-06923dbba825", "indicator--2b1f3489-cec6-4a0c-a66a-eb68f9373b0a", "indicator--d7961dab-f884-4711-a54b-cba40323de15", "indicator--ee5feef8-3d6b-4c69-852b-5242202b34f5", "indicator--6835b770-2e02-4605-a3a1-063de12e4247", "indicator--088948b2-d9b8-4393-8cd3-4d7bbeedf422", "indicator--a2824593-d52d-4e4c-962e-09c7d3fe6bbf", "indicator--1af2f7ed-8c92-46fb-98c2-f216e499a160", "indicator--ef778ed2-cf5f-484f-80ee-9eb86c61fe3a", "indicator--3644c0b4-a1ca-4436-98c2-03e503bac5ac", "indicator--574b45d9-4958-424e-8bc5-40cf4800f151", "indicator--174f985c-6c9d-447b-866e-0bdc1da2f8be", "indicator--efdb2e2b-d40b-409a-9678-8ad574649542", "indicator--5f589726-5a5b-4672-9cb8-72b32b54652e", "indicator--ae9b9f38-d83f-4de0-b279-d4f3a5207b78", "indicator--a0c560aa-44a1-484e-968f-5c512b1a7b1b", "indicator--ffc2be34-b665-40bb-97ce-6c4918535708", "indicator--9f65bcfb-c9ae-4a81-9118-37e2c38138de", "indicator--773c6038-70f0-457b-8e95-03c51e001975", "indicator--2a3af906-f8d8-4de7-b477-15828fb3d0b7", "indicator--7d5e60c0-ee04-404d-a3b9-9e65cf22475d", "indicator--855815a6-9aa7-45ac-a635-d995c536b604", "indicator--a7e74532-838f-408b-8a1d-62e5dcadd693", "indicator--c2729bed-8f5d-4932-b0e9-7d80e8f1c4a1", "indicator--152d3303-77bf-430c-a2e7-99d37800a8c1", "indicator--e5edad2c-6075-460d-934d-5aede25d8072", "indicator--72c4a1e9-afa2-417d-96c2-0e03216548c6", "indicator--01d21be1-3213-4607-854a-41953bb8b003", "indicator--8bd41191-37de-4481-8427-188ae3c39a25", "indicator--755b6777-4628-4854-b837-5f1bad0c1b1c", "indicator--32d96c35-1b0d-4411-9707-62894b82fe63", "indicator--0b22aa06-97fe-4e9b-becc-195ac8bd7643", "indicator--3d0e7287-72fb-43b8-94f7-af1f4a2c4e80", "indicator--21b10ed3-7122-4445-a133-838e373054a2", "indicator--8bd2c366-6134-4a5a-9b9d-d8e7077ed713", "indicator--44a5cda5-db54-4169-bd26-2d9dc140bb6d", "indicator--67a305d9-37ec-481c-b516-b20f817000fc", "indicator--ae0e897d-48f7-45d4-8e5b-6452c09efed1", "indicator--742372ac-2778-4ddd-8499-bb7a537aefaa", "indicator--ba35d60c-a6f7-49eb-8529-30d40026497c", "indicator--ecbf78fb-fa6d-4d88-b34e-e77334a3cc3c", "indicator--c0fd1ce2-cc37-462c-a3c2-faacbe5d0e25", "indicator--94459b43-ccb7-47ba-9f7d-5dcf71a58fbf", "indicator--17af9369-a686-4645-a9da-aec4038b2e85", "indicator--00c65003-c2a6-4e6c-87d4-48a2f1188882", "indicator--6035e22d-3b74-4e38-896d-bed289e557f6", "indicator--5be2176c-90a9-481d-908a-adb2096bbcb8", "indicator--684f0ea6-637b-418a-beae-cc99da36f18b", "indicator--a2e8efd4-a62d-495a-ac6b-b86744c61e3a", "indicator--ef28f82a-5095-4dd2-a458-5447a2ceb95a", "indicator--faf253db-7edb-4b9b-86fa-58887d5de0a0", "indicator--308c10cf-80a2-4212-9d03-9adfbc4fdd61", "indicator--b7e82584-15f1-4ac7-bc61-5d47d33bb7a2", "indicator--a1558409-4594-4276-9b15-5aa57b20da7f", "indicator--d9812ce2-76da-46dd-a041-3ee4513d83b5", "indicator--aa959cbe-b4c1-455d-b293-6ae87904837e", "indicator--d680448c-d367-43f6-a764-c470138634f3", "indicator--36684a3f-0cd3-4622-b783-767b5d2c7d51", "indicator--631953f3-8c3a-4631-9f93-2a272aa70133", "indicator--49c964ff-e81c-4750-a96b-966264654c4a", "indicator--c2c77a65-4a26-48f5-b8d4-7342c7f0de76", "indicator--05c06e37-6278-4cfa-afcc-fa0222ccd079", "indicator--54355444-6697-42bb-ac86-83fc02598dc9", "indicator--f7773595-765b-4654-b3b8-9b35591c96e9", "indicator--2b51a462-c5cf-469f-bee3-85e8242cc6f7", "indicator--f82912ef-3345-4879-a4dd-1cbbb2962240", "indicator--400d71c0-3927-4d0f-b61d-c283d27c45e4", "indicator--c4956a0b-ef58-4e59-aa07-48ef78202c72", "indicator--2b2ecd2c-2d80-4a95-8e0a-32b2ff5379f5", "indicator--a7886c36-1917-419c-a046-4a23a073980f", "indicator--aae07765-cbbd-4de5-bce8-779bf3769af3", "indicator--3c90aa33-2306-4972-ab48-01cabc72d13a", "indicator--ac014cf5-16f1-4455-b6e2-6add6d30e092", "indicator--48087d92-016b-4783-b6a4-08397744304d", "indicator--842192cf-9c72-4eb5-bf6d-413b9685427d", "indicator--931f23a3-1aa5-48a5-bdcc-cd82f9881936", "indicator--7be77acb-5b3b-4b07-9f9c-b7b82fc2f2fd", "indicator--39106b9b-f8d6-4631-ab1e-ccff2e5cea0b", "indicator--6423b586-f693-4072-90e0-8f08a0779013", "indicator--1486a36b-e12e-418d-ab3b-5c833f062f50", "indicator--08f00c73-b2b0-44f7-b55a-c55d215e0dc8", "indicator--dcaa74f6-f98b-4203-8845-82323646ea51", "indicator--5b35e9c7-a25f-4492-958d-edf5e65e119c", "indicator--832f2453-f643-4f26-9f08-908a6fe2fa95", "indicator--f87a1172-1795-4267-b0e4-64cc16350038", "indicator--995c48b0-bcb9-45d8-93d8-d807c48b3d90", "indicator--5b77ab62-05c4-46da-81f2-edb5ae1eefb9", "indicator--020715c9-c655-4f63-8c3b-3a3b507abfd4", "indicator--de642dc4-ccb7-489d-a516-d24e77fadaaa", "indicator--7c8a6405-391a-4020-bfce-a8be77fd9335", "indicator--6b3a1bb4-12b4-441d-90c7-a805ddeeb538", "indicator--bd2a7018-19a0-4ef9-9eb8-875bd5a27e25", "indicator--0dd14325-9d7b-4b4d-90c0-38fc488e988f", "indicator--fa0c22f5-14d9-4787-b2c1-d8eecd9e5d62", "indicator--b9c4331f-435e-4996-b46d-d94f19c3972f", "indicator--d86fb2be-a110-4745-baea-166e8cb9c6d0", "indicator--035e55bc-4214-41ac-b5e6-e240f65697c3", "indicator--daa37928-71d3-403c-aeef-e4f742184144", "indicator--44fa56eb-bf58-41b0-9b88-6a12222d1d9e", "indicator--5977a814-ec7c-4208-85e2-1d892330bbc2", "indicator--6cf2d777-d887-4a79-978e-cd4d6c7ce4c6", "indicator--e1f71ec5-0545-43e7-950d-15fd07acaefa", "indicator--ffa21e37-bf40-48e9-80be-eeda9cf68074", "indicator--9729caa2-c10f-462b-8daa-aef22868e814", "indicator--2fb000a7-676d-420d-9a5e-c4eb6b89decf", "indicator--002f22bd-c7ff-4e8f-a780-21d8178ed4ce", "indicator--8c606a0a-e1c8-43cb-95a0-93ca0f9c1a2a", "indicator--03ff045c-a6c9-483a-9699-183ac293da78", "indicator--fe804592-a23b-49a5-830a-5a9f363c3b91", "indicator--532b9f71-cc8b-40bc-955e-26f921fb040e", "indicator--ef2763cc-97cd-4410-b65c-af46d54edf6f", "indicator--140bbdb2-80c0-4e16-a004-db6e053408d2", "indicator--6f944c8e-9eae-49d9-abea-5082ff25d856", "indicator--4fd0877c-aca4-47fa-b9aa-a9670932a912", "indicator--8ae3fb15-97b0-477c-8903-ae0c70b53448", "indicator--af551427-55f6-48ec-9b5c-cfb98d1cd0b2", "indicator--687ce4d7-be4c-4759-9695-27df379aa1a4", "indicator--bdda9181-ec87-4c9c-b66f-af4f1a5d3833", "indicator--2f61b5ec-650d-41f9-8f57-de7dfc7afc7b", "indicator--374ecf16-8d16-4235-ac3d-4e0534a56e42", "indicator--7df0f133-1b8f-4849-946c-0f8a57866eb6", "indicator--44d50467-d0cd-4b24-9854-7145adfca20b", "indicator--2c3c46d6-52d3-4c12-ae30-a8f289cf76cf", "indicator--2b0e1724-887a-431b-bd9f-4f104082ed70", "indicator--ceef18b1-0d40-4c90-ae25-2158d2ec666c", "indicator--b2f2ae3d-a126-4ed6-a244-c2c6fd0208f9", "indicator--d98f4fd9-81ac-4800-a428-05dec8cca612", "indicator--e809a8e5-a4c9-46c6-943e-e8d083561655", "indicator--9e07dbf5-c410-4c44-8a34-845002d055cd", "indicator--0bb1dd72-5a34-4b27-98ab-d43b0162b200", "indicator--414f3789-cce1-4e10-8505-8dd45c11326d", "indicator--3f2d83dd-8c0e-4204-a91f-05425541a064", "indicator--249f92c4-679b-4153-8d66-ea512dda48b9", "indicator--29ac7703-4d8b-41ed-af62-ae369c9540d2", "indicator--c685f1eb-962c-4828-81ee-b1c18bd94837", "indicator--6cf5384c-2ab2-4eb4-8403-12186343a466", "indicator--c65ab2e1-67c8-452b-b975-75c259067e28", "indicator--92215360-1da4-4671-ba41-c79346e2aa32", "indicator--e65c794a-ae93-41ca-9e94-0f5b720fefc4", "indicator--45e3e6e5-979b-478b-bb61-b791c66bb972", "indicator--908696a8-f6f0-4aa9-946b-69eb3aabd139", "indicator--9442910b-7851-4ac5-8069-3ae4cf0a15fa", "indicator--e3662ac1-5121-415e-a558-8e893713e045", "indicator--df135225-ac57-43bf-9927-6ae3a1513378", "indicator--4acbeabb-9f4f-41a9-a808-34086a068274", "indicator--6a2b9ab1-bc3a-42d9-953f-8b12048239c4", "indicator--13dad937-047c-472e-a1ed-c0a4dff1fac6", "indicator--dbb9bd25-916b-4c10-bffa-b212b80ff4eb", "indicator--e9712be0-3633-495d-96cf-bda5609ab740", "indicator--6f1db832-f4fd-4153-948a-0e3c456dac10", "indicator--620f0ecd-d2e9-4ade-afa8-9422fe1ff144", "indicator--81d6c1ec-6f33-450a-a8b7-9318de6b8048", "indicator--999edb17-d7eb-489a-a6c5-f546206f6355", "indicator--5a4fde8f-b7e9-4dcd-96fe-97e21a762cc5", "indicator--f4794e1e-3944-4c78-80d1-212776a23a89", "indicator--905672e7-447b-46bb-8724-ef4c82ac9521", "indicator--b601c3a6-3261-407f-941b-ba236974f762", "indicator--2d128988-75d3-4a00-955b-47113c000e90", "indicator--93f7e9c0-7831-4b89-8193-ceb03629fa65", "indicator--2f0ecb4f-5712-4d3a-ac70-61a9c7a21859", "indicator--a5aa83de-073e-4a89-a1f3-fb7401baabd7", "indicator--663af8e1-bc6c-4eb4-a2d5-b135c5c76cf0", "indicator--ee4cd757-3de9-485c-a8bc-cbb41e62e5bd", "indicator--ad43fb17-24bf-4369-b795-8bd39307dd9d", "indicator--f0961a5b-4ebc-464f-94f0-06b5dc3e6698", "indicator--10db8fd3-4e56-4ed8-b8f5-f57d5ae517e8", "indicator--e71af332-ce63-4a51-bf85-37a5201f6b56", "indicator--375f69a7-a8ed-41af-b3c2-3715a35167c4", "indicator--1ca96402-f27e-4c60-8e9e-013fbb20edb6", "indicator--b19a99de-908a-4f11-9010-9dd25ec37c2f", "indicator--a52c9b9b-d92e-438a-bfb6-53dad5f7eae2", "indicator--15e92162-9cff-40e3-ab49-2eb7d0c90fe6", "indicator--e67181b8-4d8f-4949-99a9-71c970c352bc", "indicator--a92d298d-f9b3-4a07-b901-c07d0199aa5f", "indicator--6bb1d155-9520-4efa-a6bc-b9aec18d5cf9", "indicator--0dc616ff-1e58-4894-8851-ed7249447430", "indicator--e66ebb35-6a69-4d29-9a84-1b90cfb7670b", "indicator--c57303bf-4aeb-406f-bb0d-009f0f5e0203", "indicator--5c027720-0c19-473a-bfaa-32786bacc21a", "indicator--fd8d98e4-9bce-4404-a0e2-e022aa55a1b0", "indicator--cda90b27-6475-4bea-a064-c83b383a4770", "indicator--dda9075b-a7e6-4d20-bc4a-fc7f66d217d0", "indicator--91342382-1ccb-4bbd-b007-4ff0c8e3c897", "indicator--61c07d4c-22e3-4443-9e7c-8ea7188d4ac3", "indicator--b4553e94-533e-40da-bbeb-a75d83cf501c", "indicator--6aeb4336-0553-41a5-ae07-e62534a2b4c0", "indicator--77291333-fc58-4d82-afff-0f2e96e78f62", "indicator--f05001d9-597a-4b3c-b79e-f130b3238600", "indicator--3975f879-491c-4756-9c4d-e5a320e375d0", "indicator--49e1964b-ada0-4813-a9e0-7b29d55d3f40", "indicator--ec716e90-38d5-4ff2-b9a2-c8ee8f7a4004", "indicator--1a5466d5-87f8-45fa-878a-bbe332abd5fb", "indicator--587ac5b9-0b3f-47fa-9cc5-23f6d037d760", "indicator--103da721-c308-47e3-95a1-b16e5b4655d8", "indicator--43276ea9-c86b-4348-8e05-9046714c5b23", "indicator--e1c757d3-be30-4ce5-9034-a07d577af5de", "indicator--00893f6f-4f00-493a-be2f-c071121e5602", "indicator--61154202-db27-4fdc-866b-2f93376c245c", "indicator--16f0cedf-1841-49f6-885e-e01ac18d8d3f", "indicator--1a8e4724-0004-42b1-bde7-5da87653ba7e", "indicator--d6ac161c-ce48-4219-b40c-7fe70cad9684", "indicator--e1fb2020-fc05-4e9d-82e2-ca05b06a89e6", "indicator--47dd33e6-3d47-4070-8d7f-4174f93c3275", "indicator--1d83ca47-1e2a-4bdd-8d38-c3996ddbb0c5", "indicator--040c33dc-6322-4915-9085-fe4054608845", "indicator--ed5ed39a-6c8d-4830-9b2a-1b60f563bfc8", "indicator--e082af11-6777-4404-bb78-2468d0597034", "indicator--5e70fb50-3348-4862-9221-627d00d497b2", "indicator--3cb10c03-40b5-4297-9199-fe921841cdc2", "indicator--ab62908e-75a7-437d-a702-0c7528a88f79", "indicator--8d058044-7ee5-4025-8e42-fd8d11825859", "indicator--7507df36-953d-4517-b8be-2173bad5335f", "indicator--03079ca2-dce3-421f-bc2b-bee00e937e25", "indicator--69f57dc8-5526-43b5-8629-ec55671bb4fb", "indicator--1c49de0c-c6bd-454e-8b14-2dbe1f02c0b6", "indicator--d305282e-d3da-4df3-9f05-76849ff654dc", "indicator--e7602242-9305-4694-9db8-5f41ed42d6ca", "indicator--e1e05cbf-31e5-4128-98ca-3f77ebb33b2c", "indicator--8d97c5df-ac70-4329-bd57-d43f62435b30", "indicator--056a4d54-487e-4bcf-a7f8-cc4c8f62a4c3", "indicator--76c78a86-078d-4bf4-b513-b8a17f644991", "indicator--4342a1f9-1eb0-454a-9444-a54ab025819a", "indicator--866a18eb-2a73-42cf-bf96-2a794b76ffd5", "indicator--f4eb509b-0223-483f-9ca2-f43b5affccf0", "indicator--e67cfc48-6fca-4cca-a96b-86a8b3e2fafe", "indicator--10977fc3-2747-4f6a-836e-c3e004c2dac1", "indicator--06b07a55-d3d2-4058-b53a-f36a12fac6ea", "indicator--dd61784c-92d7-42fa-86d5-1910c8b75d0a", "indicator--909f6f53-99bf-43f6-98be-016c476a3eee", "indicator--01657ed2-6cf6-4c68-aa98-738a32d5cb6a", "indicator--77c783bd-e81f-4dde-ab3e-2e9a7a9491bf", "indicator--9903222d-952f-4470-84e7-4dfebaa87ec4", "indicator--5998a6c6-2fbb-4f29-ae38-eb0acfc26313", "indicator--bdc0a510-d413-49ce-a704-42aea6b00f46", "indicator--126aaff3-97d6-4d2e-ac15-7a8dc8c8893c", "indicator--a7cb68a4-58e8-48f5-8dd8-bffe9b3ab7c5", "indicator--c29a2a78-f4bb-4909-bba0-d047ce58121f", "indicator--b3628a8c-8be6-48b7-915b-f544db8a430a", "indicator--7767c590-2a0b-400c-93f9-d3bb975a2760", "indicator--2829c507-f8ea-44af-8e05-7f7bc2297a08", "indicator--393dbbaf-3fdc-4527-84ed-8cf4b0e55cf9", "indicator--a8ed3ad2-cdd2-4f34-b39d-460d9a400b33", "indicator--8990d8b9-fd01-430e-8bbc-340363a18d3c", "indicator--8b17a679-1641-40f9-b7dd-401a274fdd3f", "indicator--2384ae1f-1686-44be-8c48-aa2bfd01e58e", "indicator--304db170-e13e-416b-aeda-a3b277de642a", "indicator--df5b5d84-95b3-4514-8d49-038f9e8b9920", "indicator--815c10b7-a83a-4f47-b192-fe7026a0763c", "indicator--5be369af-fe8b-4b89-9454-45eba73ed26f", "indicator--97809a8a-7649-4bb7-80d0-9c75d537cfd1", "indicator--8e3c7433-9ffc-4be5-92d2-27ed35e989af", "indicator--74497332-0a2c-49e0-a8f7-43ee9da4ca81", "indicator--4c7a3ddf-6337-446c-bde4-3aee90b6ace2", "indicator--c21cb483-d1d6-4123-bfc8-65d7307864cc", "indicator--91ea8d3a-1847-4be7-8393-882e1b0b82d7", "indicator--0d15da4f-fad5-4e74-b223-253d50ce3ffb", "indicator--41b8d99a-881f-489e-8d37-5116356314bf", "indicator--636128d8-1d53-40ae-8ae8-0ac1af75e6df", "indicator--dc8c968e-b7fe-429a-91cb-77c451811425", "indicator--31165e53-1009-488c-95bc-e25dc9e7d4b0", "indicator--2bd6ecbe-4a09-42ef-b736-5aef8cdfe8a7", "indicator--a4f84673-36b0-4e6f-b7d4-cec0b990eec2", "indicator--ce1fdd8e-86fa-4603-beab-74b9a0ed0bcb", "indicator--799fe822-b7d2-495e-87ae-60f86ce944fd", "indicator--2ee51661-fe12-40fd-ade9-0191c38723d7", "indicator--24f73ec7-188a-4e2b-bae6-e2eeb4234caf", "indicator--e35f2aae-f167-4f95-9276-ebb7f1f01ba3", "indicator--25c8557b-bb16-4ff3-a78d-3ee2db5b5d4f", "indicator--9d43a275-53a4-488a-a9a3-352467b475ac", "indicator--9ac6df8a-51f4-4db2-8d37-923fd3fac5f1", "indicator--57d75757-233f-45d3-8e39-149388986bb6", "indicator--dac31d16-1d04-4f83-abec-56245921b9dd", "indicator--0b209939-0fd6-4c3d-ab38-a0ec475f8882", "indicator--ab520c45-8ceb-4011-8034-8c8e1f5d8c2a", "indicator--c4439337-3976-4217-b156-1d406bb67be8", "indicator--847bb2df-b256-4527-a6ce-f2dfa0c30f83", "indicator--7f6dde38-23dc-4a17-b6d8-4dc87e003ed9", "indicator--3d053e75-8360-4919-b951-edb670cd196e", "indicator--be6860b3-ed1a-4d03-b047-a70428d04ff0", "indicator--062507bc-1ace-4e48-96a3-005c4e3cc3ba", "indicator--182d9ee6-cdfd-4b30-9376-40a2ec3b272a", "indicator--41f28da6-45e1-4578-85f0-b81440e61181", "indicator--a0ce1592-3e41-42bf-b6f1-1cc61eba3eeb", "indicator--dd279cba-de57-4994-b570-7c55561b1f89", "indicator--099acf1e-b775-43aa-9e31-75c79daa27aa", "indicator--1509d33e-ec50-401d-aa75-0b73b7cc4ef0", "indicator--ae18143a-634c-4f08-ac10-7c7d701870ec", "indicator--64fc23d3-6217-4778-9e93-b6191e74e7c8", "indicator--606fb8ad-31d6-4eea-b223-d4c927b5c0f4", "indicator--ffbfede9-dfe7-4d4f-9816-a2463bf35d17", "indicator--ddc06da4-be5b-45d9-abc5-cbf410bcff46", "indicator--661eab8d-e5ed-4b11-8ee0-ef115ae3b755", "indicator--cf1788b0-e8bb-492c-aca8-370b661db8b9", "indicator--ee755db0-93e1-47c1-9403-08085fcf4e18", "indicator--fd9e7afd-1edd-4cb1-bebe-b79fa6dc2d37", "indicator--6a50d900-2d94-4c9f-847f-8213bc61b01a", "indicator--c5abb1ee-8051-42c8-9504-4d7231298dfd", "indicator--31ac7ecb-fca8-4fec-a068-dfe66a8a6bda", "indicator--b17ede0a-6cfe-41f1-a619-62a85c286456", "indicator--6b319979-3e4f-4dfb-939d-527b93d021c4", "indicator--9328c104-05d6-48ea-b47d-bd0f06fb1dfd", "indicator--a1ed58e1-ca13-46a5-89c0-9f99e3ce2fb0", "indicator--2f490fa0-8c2d-40bd-874f-b636abb79b00", "indicator--89a66b2f-9f33-406e-b9bc-0c53463d4cc7", "indicator--c0c8411b-c4fb-4858-bf8d-5631e35c6e03", "indicator--f2da10ec-5a01-41ef-b6d1-f594d5900dad", "indicator--8220c712-90d0-4e17-bccb-7b09db55e795", "indicator--6b864809-c96d-4ad5-a76a-2da38ec893c7", "indicator--22f89fda-1348-479f-9e8c-7ce770b727e0", "indicator--904d95f1-9d5b-4f25-aaa5-8eeefae7f7f6", "indicator--41bc485b-6584-401a-88dc-5ab2039c80da", "indicator--10a97918-9848-4b67-997f-a4ecca265010", "indicator--53e6ab4f-4786-447c-aef9-1e248a821a27", "indicator--223b35a6-997e-4d3c-850b-a777f5d73c16", "indicator--debc0d65-85e9-4541-9c0f-dc5e1d209d9c", "indicator--82903e31-2185-46c6-94a7-d56fa10fae57", "indicator--3b3d61f1-6ad5-407c-95ce-9bf576447296", "indicator--83765e87-9e22-4572-9dfd-238178f30c5d", "indicator--cfe1c857-3671-4983-9f02-30de2f112bb3", "indicator--bd037e31-ce15-42e7-81d5-bf994a46a2d4", "indicator--955a8eb1-3861-4c1d-88c1-69a3c10e9ff4", "indicator--3f9d5936-c53a-4025-a609-35eae03243ec", "indicator--7bd8244c-0906-4159-9cc9-9c24e8dade46", "indicator--fc27cdc1-c498-4d13-a63d-293456f53c0a", "indicator--de6cb6a6-8a3c-4fdb-8bb9-0e7ab17a9127", "indicator--4fe88b9d-0ad3-4717-8575-f8ead8613dc9", "indicator--f1c64a3d-cdf9-4fb6-bfad-de1c979638eb", "indicator--c4a12245-9252-4ef4-bcfd-01dfc10eca01", "indicator--65d39d2b-b17a-4476-acef-701685e5eba6", "indicator--b6b0fedb-f69d-4b97-acdf-f0ffc04f2a24", "indicator--2c0ad9d3-b1f7-4003-bbe9-702229cd9bf5", "indicator--efb905f4-4a39-473c-9c58-e2c4a83a1556", "indicator--7dfc8630-746b-47b6-8f6a-8020d25bea78", "indicator--b1624701-6d01-4cd8-8d10-1f29fea5e3ff", "indicator--18d7c7b0-5ea2-4781-8107-646f030d94f2", "indicator--db84952c-beed-4450-b065-995c0dd3efa2", "indicator--46e5135a-c1a3-4984-b173-45e787e93729", "indicator--2b82a4cf-7e3e-42fb-b3c6-f73d86323cd7", "indicator--84480073-e4b6-422c-b5cd-2c06e3f65a65", "indicator--179cb8e3-3e54-40cf-b0d8-a9a8f86e1b55", "indicator--4ef0b2fc-f579-4fc4-9490-3b035d9bc693", "indicator--e8c95538-c100-4440-a1ab-5ed94dfc89ca", "indicator--69a5b9ba-5d28-4928-9e6f-003aea8cf879", "indicator--711e8bca-52ed-48ed-80ce-033bc0c8c30a", "indicator--cde36fa2-3770-4ea3-9d15-4492d298b655", "indicator--dc858485-7e6f-46b3-b70a-b3b45280b812", "indicator--1debc22a-1858-45f0-b5d8-f833b7c84e33", "indicator--b9648f6d-8076-44fc-901b-4aad029d20d5", "indicator--c1f55893-6ef3-49c9-9d5d-fddcb137b6f1", "indicator--f874e69a-96a7-4e5a-bd94-9c34e6e4fe04", "indicator--9c891243-1843-49c7-9adf-96072479f22c", "indicator--07644eb0-0589-4e88-b871-b35ce7b95439", "indicator--0614bccf-24ee-4339-93c1-4ef2324b19c0", "indicator--82f2b806-7578-4163-97fb-475b66f4b770", "indicator--1765ce23-cd57-4a56-bc6e-033253fe79b7", "indicator--48364318-b476-4315-9f59-0e288d32a4b3", "indicator--1e7b58e4-2566-4234-b5db-206406e5d556", "indicator--45578eec-60f3-425f-86d5-d9b3d67d8521", "indicator--5ba5f2c2-06ae-4b05-bbf2-6479186ab843", "indicator--e1d7146d-adeb-4bba-88f9-78546eba5695", "indicator--b88a1536-455b-4a45-a2c3-17a1d28bdf0d", "indicator--a9d5ebbf-6609-40ab-a56c-96d5489fd9e3", "indicator--a8002ed4-6e81-4a86-8740-7597d4d67ca2", "indicator--312a31b5-8998-44e4-b5ad-5488e0933b5a", "indicator--0a6f89cf-e39b-4e72-94ea-baa4f7d7f563", "indicator--ac33089c-6a25-41ab-92c9-a564bb5a9d6a", "indicator--3d40d247-970e-468f-ac19-b7f56c9f9b6c", "indicator--706d663b-57f6-433e-b5f9-0d44ee8af4d1", "indicator--1ed5b24d-8138-45fa-b6a4-847fc7523184", "indicator--e6cd1acd-2ad4-445d-8cd8-ea20ab50da1e", "indicator--43ef79c6-7aa9-46aa-b0f8-d76e0a30cdca", "indicator--0b8cbf90-d25d-41b1-bfc0-868510d2abbf", "indicator--6c556abb-6073-4f05-beff-b77c45425aa2", "indicator--bed0672f-e4b8-40f0-bf58-8f836d25ab89", "indicator--48deb943-35b2-485e-83c8-04b687b78d9d", "indicator--f27f88d6-dc34-4cd5-96ab-fc595c16c713", "indicator--f8899754-69fc-48aa-aa21-48b8c537795a", "indicator--bd4ae03e-83bd-49e0-a833-93adc3808ff5", "indicator--680cad84-1d1b-4bd9-893d-51fdabb3b5d5", "indicator--3c36e657-739e-48af-a716-5871b0e35446", "indicator--4ab3163a-3801-4310-9e39-e03a438a57eb", "indicator--204cb8f4-2723-4a09-ae4e-ccfa420365e3", "indicator--043ed3b3-67bb-4370-8b3d-44c6569e643a", "indicator--d33952d3-3940-4b24-bb05-f52a8a4cfe9d", "indicator--643fcf2c-00f2-4eda-92e9-5a107d67e1d7", "indicator--0fd94ba3-7fbd-4366-8c6a-0333e0db5c7e", "indicator--5518b1a9-1a38-4a70-8fcd-5d8c4a09de62", "indicator--89dd6114-ebc1-48b7-818e-151ca92739a6", "indicator--a666bf41-7c7c-407e-889b-c9cf144d0340", "indicator--7b89bcdb-181b-4e3a-a754-3c4f87f231fd", "indicator--1d479bd9-6d57-479e-985e-b331d433c6e7", "indicator--ce4ffb07-e9a1-4523-a66f-c741e11d5f12", "indicator--962c05ae-0e40-40ad-85a9-698911138ab8", "indicator--a7545006-ecef-4b4d-bfdf-a28dcee9d221", "indicator--140374d9-33fb-4c5e-bd25-a7092a07d5e3", "indicator--685c0c8c-e261-42bd-b6b1-418b21fff88f", "indicator--978bcece-2b7f-4d99-bce9-87b9c67a0250", "indicator--c067ac97-3cb7-4905-ab35-c828ef6f6296", "indicator--394c2aca-c333-40fb-b410-3d5fc72ec592", "indicator--11bc51a8-4966-4820-82fd-94f044463492", "indicator--81ae6ec6-b544-4759-88cc-de061302ded5", "indicator--40a32556-5cb4-4bda-8b0f-55592b02fdf5", "indicator--0ee8aa4f-693d-45cb-90e6-5d0f8bcd86bc", "indicator--a74fef4f-583a-4e6e-9aab-6c76c9250d63", "indicator--8db37f79-8ffc-4038-8a9b-bb5884e7e7f1", "indicator--6fca82fb-19e6-4eac-bd2a-09e8b76493d8", "indicator--dc6651ee-bccc-4e08-b669-fd645cc2ae75", "indicator--2c265e18-afe0-4f62-834a-022ad3e4bca6", "indicator--dbac080d-e786-4876-9877-254cd133d965", "indicator--04f54752-4ba7-4dab-8ced-0fdcbb4f0e60", "indicator--f54e851e-76e7-49ce-80cb-237a41269526", "indicator--5dc0ae94-0b39-4757-aa35-80c22c15f40e", "indicator--33fdb5a2-13be-48cb-85a2-4ffa6d6a49ef", "indicator--6fc6dfa6-ba82-46ef-8ff6-3c8ef84b2d7e", "indicator--9ab07142-4883-4e54-a385-564e2764d6b2", "indicator--6af22fd2-eb9a-46a1-b54e-b6c9057827ba", "indicator--155eaa87-ff39-4ad9-ae53-50ade3615fa8", "indicator--ffe5146a-db27-4964-b902-c01136f1c32b", "indicator--4f24c668-dacc-4a94-977a-c7bd146c705d", "indicator--faa2e240-5cda-4cb0-a1dd-76d426245703", "indicator--00bf6d5a-3fac-490d-affe-392d48ae604a", "indicator--194e1896-b7cd-457c-8b3d-db8533fa67d4", "indicator--f910db9b-a2e6-4b17-84e3-bfc5097527f4", "indicator--91c0d789-2dfd-4f3d-8992-7515ca218f4e", "indicator--a05b81d9-07e1-4531-aa64-fdf0231cc739", "indicator--4ce3562b-a8cc-49cb-969e-843f93489314", "indicator--433cad5d-5332-4ba7-adda-e68e51a48406", "indicator--b66c2f53-394b-4375-881d-406a96108ed6", "indicator--4d9f277b-a5fb-4b08-94d4-ad2b69001b61", "indicator--579601d0-4308-40d6-9484-75cbd9a58cf5", "indicator--a27c6d42-25c9-4dbb-be08-8419d3ec2dc1", "indicator--af938f69-0e14-4eb8-8a3a-15c86e5d3dcf", "indicator--429e516e-12fe-4be5-afc7-e19a19323ab0", "indicator--38574826-2f00-4e3d-8f57-a1d7dfcc3690", "indicator--640c7b41-5a43-498e-be20-c3cce5592384", "indicator--accee324-2d93-400c-a58c-47efc9ef8a36", "indicator--700c4864-9ed8-4839-94dd-ef2f9fb587c6", "indicator--1a267ce8-e2eb-4b50-a81f-b6b9b9215aae", "indicator--46f3e91d-1544-43e4-9ee8-4708b242040a", "indicator--cb1fdc98-24be-4d2c-995d-05e98c00dc5d", "indicator--c90a2799-f2e6-4fef-990a-eced736a0410", "indicator--b1c71282-0996-4d32-a6e4-76b10c60b96b", "indicator--549af79f-6f9c-43d5-98ba-f14f8897a6c9", "indicator--c7895f21-23e7-41a9-b0ee-8624d6d2085e", "indicator--0b1ea4a9-8048-4bfd-bbf2-a1d3e94b6153", "indicator--478116e8-c404-4512-80d2-5672b5e9a2ee", "indicator--7099a87a-ddca-4887-bc12-8c2c0f143bc0", "indicator--7792afcd-cad0-46f4-8242-3ef43247928f", "indicator--68311695-1cf5-4b74-b8c6-f228a6294095", "indicator--f16ca8b5-f0be-4833-a372-5c836010e46a", "indicator--d628ffab-98e9-4a30-ba14-8da0ec98d8d5", "indicator--fa590076-b9f4-4941-8efc-63e3b7c7af1c", "indicator--1772d0d7-4d0c-4fb4-a6bd-0977a54e365f", "indicator--711c64c0-926f-43e5-9617-677f32079ebb", "indicator--d3b96f95-8160-41a6-8a4b-5ec99179ab9d", "indicator--9a988d67-59ab-4a54-91d0-4f4608d9c4c0", "indicator--6d66360f-8dbe-4d11-8298-67385f859b4a", "indicator--587c49bf-c632-469e-b3b0-6fa1f7e37e10", "indicator--11605dbd-a0ff-4c65-8101-8f3f2bd71db8", "indicator--59c9e6d1-9af9-4293-9820-d8c94bbb3ffc", "indicator--3a7904a0-e888-44d0-b10a-438886db7918", "indicator--eb332111-0322-4c35-97a0-973bcb4a6896", "indicator--a38917a4-cf38-4c02-9b79-bb5683f1381e", "indicator--df846e61-62f5-40c2-90a6-0fa738194c6c", "indicator--ec801e03-dd8c-4247-905e-a3180d9af66d", "indicator--bb150aa3-ebc6-4297-b8e3-c31b0fd90d29", "indicator--e8fdb3c7-7bd5-4f8e-bc40-90caebc4ac72", "indicator--827b0b38-024a-4da7-b80c-a8a710bbfbc2", "indicator--4bf1653c-1129-491f-9e76-592e683b1af6", "indicator--183d6721-0696-406b-b65e-056f34dff85e", "indicator--18f53be7-d806-4f32-b3d4-a74cbc120696", "indicator--96960b86-c5cc-44df-ba10-1d8ae081a5b7", "indicator--04fd0e82-d2aa-481f-89ae-0be8c3f11225", "indicator--dba14906-0f09-4e0b-8922-21b64d3b23de", "indicator--6116b777-d19f-40e6-b184-3959ba6c9fed", "indicator--9a1dbcde-7379-4b43-bda4-d1ee9b527497", "indicator--a1de37b1-414f-4985-b975-a47e9524f2e8", "indicator--a16b9d13-2771-4e3c-8fa1-49a21d8fb21d", "indicator--9232ecaa-a885-4ef4-a643-b6136078770a", "indicator--20733880-5d59-47b8-bcb9-c180893b5395", "indicator--a6f77e77-3814-4053-8515-f8060a84e00e", "indicator--3a78712b-44fd-4233-b1cb-0f02dee4075f", "indicator--40ff10cf-7709-47c3-b392-0c95eccc1573", "indicator--10eaeee9-daa2-4154-9797-1c91b20c0eb5", "indicator--0e4410a5-cb7f-4f01-bac2-6af204ea3f98", "indicator--2e87cf45-7c26-453a-87fa-910a016f4260", "indicator--8267e53f-c30e-4bf7-aad4-12f40f811472", "indicator--c0858879-49c4-4102-b98e-4508b149e649", "indicator--6837b6ae-c7c4-4048-a38a-788e81214b19", "indicator--9b5b6fa0-9ddb-4b62-a623-b030499cb31f", "indicator--afa80e9e-9b90-4952-a492-4946453b2b55", "indicator--5a45683f-8245-4245-a7ae-6567b152ebf3", "indicator--9d169904-66b6-4034-829a-19cb2ba9ce97", "indicator--cbffc567-7e59-4bc4-952f-4164ca1ddcc0", "indicator--203d87af-fde1-4697-9e0f-9bf235f6a7cf", "indicator--eb4ab240-27a6-493f-8fa3-fe978da8a5b3", "indicator--9e371f7b-fb36-4397-9c9c-bd490b4f30ef", "indicator--98b2ec9d-9ee0-4d31-a47c-eebaff806a69", "indicator--a96c15bd-7cd3-4742-a030-641c0700ec18", "indicator--2d6bb78e-1bdb-4e50-bfcb-4e3d9250cfab", "indicator--b73b69d6-4177-401c-8244-fb808f5246b8", "indicator--b5363bdb-f64a-4ded-817a-5e78e8b3be31", "indicator--457d7b02-f786-4cd8-85b9-de82c274efb1", "indicator--b3ff2985-0e21-4e4b-8470-7f3183490cb4", "indicator--97eca48c-6e8e-43ce-a466-7267c35d285e", "indicator--cadf14c0-9b8b-4a77-808b-234ca71a50af", "indicator--afc9ebc5-d3e3-4fc5-9203-f8c1db5074fd", "indicator--134e36ff-61c7-4729-bcdd-fe5eb0a93bb4", "indicator--955e2935-05d8-4600-9952-6c3677c212dc", "indicator--f835cb33-00a8-4c08-bba0-07d827a14c99", "indicator--904668ad-2f21-4f6c-a348-10effbb9ab04", "indicator--ba09fada-9cb4-46a9-ad98-a0b7581c7db5", "indicator--0397b269-c4bf-4dce-9226-f1e4a4ff3faf", "indicator--007597bb-b73d-4ef3-b35b-4bc8c1c551f3", "indicator--eb8c782a-f8c8-46d8-ae93-4f18963ddcf7", "indicator--8a158d1b-323b-4826-9dd2-00b5b2251a34", "indicator--7e33380e-c49b-4a69-ac96-47e7fe23dc46", "indicator--15c3992a-8177-4cb4-8816-d2810928beb4", "indicator--602b7480-82b8-41a5-952c-bc499ed69c04", "indicator--193de47a-ee8c-477b-8aa9-cbfd1a9922a2", "indicator--f30f0b4b-50cc-4b20-8e09-3b744f39913c", "indicator--d3a8fe45-11f7-43f2-8c1a-8c6f03b77a7e", "indicator--f324f6b4-f763-45e4-929e-3e10b21998ad", "indicator--2825f36e-bac9-4215-8922-05aef63415df", "indicator--a1ba5031-9185-4cff-a855-b08ebb273942", "indicator--891fdb4b-d7c8-4dcb-9dc9-c2a371b0811b", "indicator--6981107c-61dd-410d-9fc4-07ac1c27bea0", "indicator--f5f2d7dc-b867-47db-87e2-471eb3fc2811", "indicator--7985fd7b-8a63-44e1-a952-92f5e069ee9b", "indicator--73816428-1c33-41f9-b882-b243fc6282ff", "indicator--648acabb-8248-4d46-a8aa-b9845d449e2c", "indicator--68b5f93c-2539-4382-a8d9-eaacb651e955", "indicator--c50cf4f8-6a87-4d0f-9b4c-26780f5d0baa", "indicator--c2840a68-93cb-46bc-af01-d8de8dc31c58", "indicator--45428f3c-b228-4010-9a48-de099604aab7", "indicator--8f3b0a57-cc63-499f-a478-50bbe49f36da", "indicator--40e71f29-3d83-499a-8fc9-6856b7a4ec26", "indicator--4e82774e-c4f2-4cd0-92b2-77abe76b6fef", "indicator--0c90e45a-a8c0-4135-8927-8b949043283e", "indicator--5d02e005-de5e-4d1f-9677-e8eb513cec07", "indicator--45e3aaaf-0910-4052-bc87-acd95d811141", "indicator--9df3e62c-c6e7-4672-8f8c-c2c36e1dffc8", "indicator--0d575004-16dc-4c3a-b8f0-6327a7e4f6e6", "indicator--4cf94b0e-8101-40b2-80db-cd904ba5150e", "indicator--fa1ec4a8-65d9-4e06-a652-a01202d249ca", "indicator--d3dbb1fa-97ae-486c-bbcc-433d04e40a4d", "indicator--eb3a3962-d6dd-4e11-bb19-0dccdc5bbe4b", "indicator--5e8d3475-366b-46f4-8f57-42f682a129db", "indicator--86ea7101-52fa-4fb6-a960-2e30c9f10a3a", "indicator--e05cfc98-50b9-4c3a-bc22-0dab632ab331", "indicator--36c42149-009b-4a8b-8426-8db9c3376a56", "indicator--58b21579-647a-4f90-8de6-ae40b0615405", "indicator--4ee8a7ad-7bc7-4d04-bf23-0d8eecf6972e", "indicator--1819841e-572a-4df4-9de1-b0e849d00b3d", "indicator--a48bfc42-d82f-4e09-926a-84f6c18085e6", "indicator--e73d5c4f-9556-4ebd-a2d0-87a95b119b2f", "indicator--380a6f8d-3f96-496f-80b0-22e8fea823d6", "indicator--198f4ec3-27be-4399-ae6d-450a812372e3", "indicator--86cffa99-da43-43fd-b579-1f68349b205f", "indicator--efd3a8e4-2e74-4090-8fc3-405acc7ba22b", "indicator--9124630c-09d8-4478-865c-27b273aca551", "indicator--0e329014-7d56-4b0f-896f-3760a8269807", "indicator--be195bdc-8465-4974-8584-9f09af7b3345", "indicator--50cff91e-7570-4488-bfd4-497f06c54848", "relationship--d16efa6e-c6fc-4731-abf4-842ce61bcb4f", "indicator--20633e28-298d-4e35-b8f4-0f25df9371c9", "indicator--99bdb62a-c298-441d-8f62-f242820a59f8", "indicator--7f3dd5bc-d7cf-4f26-b570-0db72c0ffdc7", "indicator--d2646ccc-400e-46f4-9458-24eaa02fe9e5", "indicator--de188214-05d0-4800-9dae-fd3149916c6f", "indicator--ada09ebe-1c90-49f1-a5fd-1e4c2d361a49", "indicator--9b59a807-6b50-48e8-9530-e82e358cd82c", "indicator--b2e96ab3-2f11-421d-af98-42fa4cf6421a", "indicator--e843a7af-565b-4b67-935c-d36c709d312f", "indicator--63798842-5192-4779-b887-2e9b3496c22e", "indicator--2f9065a3-ea20-4cac-8f6d-6cca38c7be73", "indicator--04b9affa-6e15-4ccd-b7b0-0fce7d64463d", "indicator--da892fc5-d20c-4c85-aff9-ebfbbc84930d", "indicator--fd453770-101e-4df0-841e-0df20a941c71", "indicator--3d0d84f9-34d9-46a9-bb6b-f2f3fce0139e", "indicator--3ca1b21b-75f5-4b8c-bfdd-8d168f482eef", "indicator--3d1c3ccf-741d-4d2d-8161-ed77169b1f8d", "indicator--40cc4300-8699-458c-8d23-2ee4d8539a13", "indicator--8aa33d19-5113-4c21-9283-8f8252d08978", "indicator--90dea37e-0869-4e20-8450-c68ae0c57082", "indicator--bc55e986-c247-44f6-877a-ef6f09791481", "indicator--ce1c3ae1-ef98-4eed-aaec-70d0f34fae0c", "indicator--200664a7-fcd8-46ad-a4cf-6513fc5fc4da", "indicator--f55aa858-bfb2-49cf-8729-7069947decf1", "indicator--0a6af71a-bf83-4794-9ee0-9fea2c221e25", "indicator--82bbb6c7-3b3b-4034-8969-de8f291b896c", "indicator--fc1ca520-37a9-4b44-8776-a46d4e785832", "indicator--02218e6c-d038-4e44-8d99-5bf6c1ec16e1", "indicator--6881fce2-9072-4c33-b82f-fadb5fd3fdf3", "indicator--80f58702-b533-470d-9890-6441b85accb6", "indicator--2fe2454a-ab65-4455-9859-498c67551a04", "indicator--f49a7a7b-dfe9-402b-9723-7f8b4a44fd47", "indicator--80342d7a-e4b2-442d-b9d4-020385e4fc06", "indicator--9d9e5727-9e4c-4730-bde0-abb51eb69b09", "indicator--9c116cc8-00c5-49bd-a3c4-6fdc37d07e53", "indicator--2571cc02-f4e9-4459-9b38-28d0445a5ab8", "indicator--130b198d-a0b5-435e-aa83-6d167b0480e6", "indicator--facbc870-7e4e-474b-8272-1d03b322613e", "indicator--bd7a4e76-f43c-4864-99be-a22c7fa3190e", "indicator--7d980985-76ed-4c6c-a11b-adbb7857bb9e", "indicator--ee6c9e92-6c26-4bc1-adbb-247e03f878c3", "indicator--117fbefd-95ed-486d-b742-c2824e6d75fc", "indicator--a0abebc9-0488-45e7-8647-6165296ddba2", "indicator--e3f58adc-251e-4342-bc7f-9f7b1f0af70f", "indicator--b7ee0f60-b1f7-433a-bd73-8a2d29b18b5e", "indicator--a9b16964-e62a-452d-b338-73c5ff9a546b", "indicator--53802c3e-101e-4687-b2cf-af7b0ae1fd7c", "indicator--0cb104f6-d7b6-4ed3-bd67-6d82851d8093", "indicator--7fc28c02-8e5f-44c7-9ba7-6110cfbdc5c1", "indicator--975630ad-d01b-49b0-bbbc-4213d4f66cef", "indicator--348d619c-250c-46b9-b2d1-36f3afbb6089", "indicator--ac298aea-8079-44ca-9d4e-ef4a74654e91", "indicator--1472c138-a144-4430-970e-4074124adfe7", "indicator--fc3fe521-d89a-42f6-8f7d-391ec3f9a63b", "indicator--707a374e-d159-4f0c-9754-64deaf0675cf", "indicator--f692c24c-606f-45e6-8603-81cb0196c172", "indicator--0ff1d863-d535-4a56-9c15-17e0d930b565", "indicator--a3a4bf29-6ded-493b-a34b-820bc0c70920", "indicator--0c9de37b-3c84-43f9-a451-f6f2f1889663", "indicator--efe7f90e-d69a-409d-b4f0-6b488f23ada6", "indicator--30ddb8a6-e70d-49c6-a281-c0f8f0fd676d", "indicator--2308e66a-da3e-4d10-b79e-49af90a457d2", "indicator--10d3d40e-b70c-4129-87a0-5e449c9ae930", "indicator--b8b02ae9-bee0-47d4-b158-44c2ffe33560", "indicator--3b080ba3-9f6c-476f-883d-9531bfa9af17", "indicator--93e19171-52bf-4e1e-b213-1ae8633d8d54", "indicator--cc44677c-4d8c-4e98-9968-c3978e36d80a", "indicator--32bb3ecc-28e6-42e8-9a64-b681f24ffb07", "indicator--8320d4cd-aa89-47ba-8393-00a5cb3822bf", "indicator--b442566f-3415-4c6d-9022-93c8097d4385", "indicator--055e3fe6-1a5d-4c90-9383-8333ccd0c559", "indicator--1f1824b2-239f-445f-8a3b-2c25b1922926", "indicator--d6de369a-ab83-42de-82be-42121a74930a", "indicator--7f4b9cde-2cc7-4dc3-8dfc-5fffc0ff3bf2", "indicator--c24a4b1a-caa9-4399-a152-b1c7de0308ce", "indicator--ea1f0a48-a5cd-43d5-a136-8f4a7ddc5cfd", "indicator--ae3f3470-a79d-4040-b74c-61ccea910586", "indicator--98456ba3-a33b-4025-bd92-3d2e1f161ed0", "indicator--3b950e41-abd0-4a19-8aa2-616a73b65f62", "indicator--405632d0-79c7-48e6-98da-986b5a790dc0", "indicator--d3c15d07-f7c0-4d27-8f31-1a488efe3e74", "indicator--b4c0dc2a-876b-4597-af4f-3c99eb9b021a", "indicator--d8c91870-5c12-4478-8fa6-89298a4a0e62", "indicator--f44c183a-b6e5-463e-bcbd-718698c6b30e", "indicator--eabd2b20-ce91-4208-b000-05766dadb0a8", "indicator--20917329-81a8-41bc-88ff-49ba2adffce8", "indicator--8f9041d7-f188-4326-abc2-0dd4a1b06f3b", "indicator--472ac426-3453-4753-be7d-a7ba7f5b7c7f", "indicator--54ece9fc-f0b8-45ea-8e2c-ac6faef22e05", "indicator--a9fc3857-f39a-479d-9efe-b807f86ece9b", "indicator--9043b4f3-7d35-4024-bc5b-67cc9f742a68", "indicator--fc47179c-1077-4456-be00-3c4c76950545", "indicator--c0419e40-8bff-4ba0-b4cc-8622f8af01b3", "indicator--d8f04582-1d05-4524-b0ba-bff3f0ed7262", "indicator--cd613314-a791-4508-985b-eb7587265606", "indicator--fdf8132a-7eda-4d13-8e9f-a27dc0cdc46a", "indicator--8382f03e-5263-4b7a-923a-5ed232d58ec3", "indicator--2dc3739b-a704-481a-9822-c0c7288ae609", "indicator--03d2958a-f3bf-4126-921f-84a7b3d63611", "indicator--c191b4eb-2850-44c9-b070-ac8c9a549fcd", "indicator--14a90c7a-05b5-4e04-825d-fd1acc1074af", "indicator--b3c2575b-c2e0-4cd4-9c1e-0d92457718ea", "indicator--e170034c-8685-4b59-8ff8-48a609aa451e", "indicator--8fb71b31-6fb0-42a6-979f-ef7157b05991", "indicator--61d2601c-be8e-4277-9195-3dbcbc21e270", "indicator--bf3277cc-ba08-4533-a9a9-aebbb2f4bc1e", "indicator--41f7ed58-fb8c-4eba-8c89-00f54b54a40e", "indicator--62c0778b-7a2f-4844-8251-865f8a814cd5", "indicator--8e406797-858b-4836-9463-2c624c77a3fd", "indicator--951a8e1b-a02e-402c-91fd-0b9a9fe5a61d", "indicator--9ed945f5-dace-486f-8c50-48ea6739e4d0", "indicator--5ed84438-de40-49db-9bfa-d09d9d704b40", "indicator--6e1fef7a-e4ad-4c74-ae0d-7d38bad7e15b", "indicator--8a15a0cd-ffe1-4d00-8833-3ed4e85bc938", "indicator--6ebaf1df-dd76-4c87-973f-471632b782e4", "indicator--b447b46a-14db-4655-b380-5d631f6a272b", "indicator--b2b775d8-66ba-465f-ae46-52d6107c2764", "indicator--ad5bcd46-5bba-4efd-8208-6e51c33f8c21", "indicator--f29f556c-445b-4084-9d5c-91a3e378b20e", "indicator--1e03d015-ccb1-4f35-88ad-d90f02b7de20", "indicator--37abd40b-46c7-495d-afb9-09073714abd0", "indicator--8642c99e-8c14-44be-8173-c0f8ceaa91fb", "indicator--473aedbe-2ce3-41fb-a254-dec63cf2ce1e", "indicator--67affc9a-548b-4162-a573-52978a813b3f", "indicator--52839a18-7a89-4f16-bc5e-31f2353fa627", "indicator--6ba44474-1326-4775-b273-41b3f3eab74a", "indicator--e67de5c8-53b7-4b03-8dc4-33dc23c2acaa", "indicator--2ca3319b-61c2-4d66-b361-79157ee260f3", "indicator--e4bfa344-bc09-42a5-a340-cf7d022ccfe3", "indicator--5fc403a6-1c1c-4e04-a2bb-c544ff444b50", "indicator--2c094789-5566-4107-a007-dcd5362ffe71", "indicator--bf6b18cc-5570-4272-bfbf-122a4ba208ab", "indicator--2ac19de4-71d0-4577-85f8-cfd484dc366c", "indicator--a67828b3-27b7-48d0-ab79-a25e482c8833", "indicator--b57064b5-6d2c-41c3-ad81-e7a83ae25d39", "indicator--973574c0-6dec-4480-8177-632ddd2ad2d7", "indicator--ee2bfcc1-bc71-4f92-857a-749c93a267f7", "indicator--96a0b81b-86fa-4592-aa71-bb1329df4f8d", "indicator--e54121dc-edf3-4eed-9274-4f7745578433", "indicator--e564d49f-6374-4f28-9fef-01e0156da5be", "indicator--0b81d71f-8cad-4f4e-8edb-2956c199ca32", "indicator--d1751fa4-32ff-4aa3-a862-a64d54488b97", "indicator--e969c497-2112-4a2b-97d3-2207337eae03", "indicator--57484cc6-ac18-46c6-8fb6-eb1d29d2a6da", "indicator--041f19ec-ee43-4551-b7be-0a5ec4a7b22e", "indicator--380d5bdc-c701-4aef-a35d-54fe1bfa1a00", "indicator--1ac09d7d-d847-4578-844d-1149f2d3e7ee", "indicator--5df843b3-e538-492d-b780-ebcd27a67b0d", "indicator--7df7e38f-5155-4fd9-b843-ed80e334c243", "indicator--d3543dcc-aca6-4a86-99d9-3cd303f4dd45", "indicator--0215662e-3dc0-40e7-a2cf-f799881392dc", "indicator--5f0fcb91-1563-4094-90fd-33fbfe1373e7", "indicator--351d4776-f103-4253-b72f-46001f872975", "indicator--ea84e5b2-b138-487b-b11b-927021499daf", "indicator--4ee69cd5-b989-4b15-8d6b-ae66fc80d6b5", "indicator--e8edf086-e96c-41ff-935d-d7ddd5c2e0fa", "indicator--28bdc1c4-53c8-470d-bfbc-9b2ef8750585", "indicator--d7784207-bcd0-4938-b525-a38a9cebfc62", "indicator--0bf79d72-8296-4660-9ba3-2944764ecd9d", "indicator--b831e731-f279-4622-a2b6-32b03e831020", "indicator--be316160-86c8-487b-879d-2bbfd6f99a5d", "indicator--2e1c41de-6340-44d5-82c2-08e5f6b07faf", "indicator--90fe4e5e-00f6-48aa-8b21-ef20053726e9", "indicator--3e97172a-e6c2-4a52-a700-e1fd296c60bc", "indicator--ffd232f4-c0a9-4adc-9b31-c92e91339d2a", "indicator--d28642cb-66bc-4c83-a722-1296a6d65360", "indicator--2a5b232b-a19b-498d-9c16-f3d9acbe2499", "indicator--464e5033-790d-47a8-b83f-91e07a742fe0", "indicator--c6220e54-4770-4337-8457-6556ed89f28f", "indicator--da475c21-dd7a-4950-851a-6865534fb840", "indicator--69a3c9db-3cf5-4dc3-9e68-61feac7a8483", "indicator--1435fbd8-7a5f-47fe-a1d7-a787abf1075a", "indicator--b4f85189-9c65-4a31-92c8-21a9cb6ec09a", "indicator--f5c16ce4-8383-4a75-a4ee-1b238ba6da60", "indicator--0130bcd9-d175-4ff9-9877-ad87115d9fca", "indicator--ae16b247-0882-4d8a-aadd-38a7fdeb5133", "indicator--f7ea9dc7-e0f1-44b3-b615-68f0a0bf8cb1", "indicator--8aea9dfa-4e8e-4e3b-9426-2503e5ef9cd3", "indicator--ef36b6fc-73b3-4ecf-8c08-4fabc45b41cd", "indicator--76dac8e1-e624-4960-bb75-c4f20281adbf", "indicator--4b9d1ca1-5ac8-4589-91c2-2f72e734f17e", "indicator--a090c497-07cf-428d-a40e-a39c6a378247", "indicator--83b6232f-b434-40b2-8db5-227f521878c5", "indicator--4a3a6cc2-b657-4ab8-8951-239e71cf2c31", "indicator--1a465617-6a1b-4aa8-98a5-32a343f5364c", "indicator--4576494b-183d-46f1-ac1a-527a88a29c9c", "indicator--ee16f99c-e195-4617-a5b0-41e7082a083d", "indicator--7d89935d-16c8-413d-8680-095d419cb2ee", "indicator--a13b3b9f-715a-4701-aa56-af6dba0791b2", "indicator--d6293b24-0d3a-4c1a-9951-8962f91c1b83", "indicator--33af8ba0-da90-492a-9fda-9fcb73f238f9", "indicator--55ee782c-d790-4ad9-b2ac-6872f8c937d8", "indicator--76ae47fc-1843-4c93-92a7-7f41a72fef7a", "indicator--0019466f-9d9c-40d1-94f0-ce855d52638e", "indicator--0546b7d4-1718-47f6-8f8b-a05fa289a954", "indicator--01fbcf2f-05e0-4a6a-a5f6-68d33d19d829", "indicator--df201f49-1256-40d5-9f7a-00f971cb8761", "indicator--71e00cb7-d0e4-4522-93f1-cee07b4c1445", "indicator--f0fb8151-038c-41ab-8304-94732d135fc1", "indicator--1c10f984-2cf9-4fd5-b5fb-0ccc0101e97e", "indicator--a3f6a01a-27af-41d9-923a-9349b875cc35", "indicator--01a8aa5f-95b5-4a57-a21a-e3a0d6a7aa1b", "indicator--e2019259-4b80-40ab-8cf5-7432927d67ed", "indicator--b6f032d8-047d-4bc4-b7ea-d69ec28d9a71", "indicator--5623096d-df9b-4694-8885-a5b6b926c6a8", "indicator--9b495ccb-6a63-4777-b8c9-8a7c663b76a0", "indicator--43de214d-ffb1-4d7d-8911-cf8b75904f9e", "indicator--bb5c8ef4-7814-4273-9c79-d9646aeb599c", "indicator--66d84b55-96f1-4702-a775-900cea086aa2", "indicator--abc16421-149b-4ba9-922e-84dc99bee41a", "indicator--9d56c820-ce14-4807-8a2f-a975c210950a", "indicator--38038a61-ce1f-443f-af1a-9527924d69ff", "indicator--ebb3c657-79ea-45cf-832c-2707fc7f86a0", "indicator--d36e62d0-8c6c-4217-be0a-2afc5fa5903e", "indicator--cc4f3fc1-f56c-405b-9e19-30151de30197", "indicator--cf755883-9547-44b5-9cdf-862fadbb435b", "indicator--4d301f14-a432-41bf-8290-2a07047928ec", "indicator--a7df5457-bbb8-4f2e-967b-0e545b9c9a34", "indicator--fd3c5d69-9eb8-4e4f-80dc-9e7e9b50a7c2", "indicator--7af16465-3e7e-47d7-8d49-ba6664ae5151", "indicator--5367888b-21cc-4654-932c-d2589a4469e1", "indicator--92707fc2-887e-4e41-86e4-90aa9c10dd5b", "indicator--b77f1e6a-5c86-4522-b42e-2f8d472e5711", "indicator--88feafa1-7860-41b8-a148-f0434bbba335", "indicator--680a48f4-e5ec-4bee-a6e6-ebc785de34a0", "indicator--a512563b-9850-4d3a-b24d-ebfaf6964814", "indicator--7faf03d9-e5cc-4870-915e-a091c6dfcf17", "indicator--bf51c73d-4f74-44d1-b996-a85d475d8709", "indicator--0753fd38-884a-4d93-b7af-d233fdc3d482", "indicator--bcc576b3-9b63-4455-b717-25c5d9bb88bf", "indicator--2f76f05e-2626-44cf-8c21-06b3886a47a2", "indicator--d041ae93-8294-4066-a40c-c2daac5f2c03", "indicator--ff0227fd-5f8c-496c-8688-425b3db3f15b", "indicator--2a7c6f5c-8f6d-4fce-9579-0356cd63a6a4", "indicator--2e02c026-dfa0-4355-b108-1b1ab457c75a", "indicator--b22afc7d-05ba-41d6-955a-62a0e4e783ff", "indicator--055cb28d-b071-4549-8343-e5987d8a4e2a", "indicator--d648cf33-4ab0-4397-aa50-50ab80f1d9ca", "indicator--753b7fad-da7b-4467-95ed-894415f881e9", "indicator--e976f6bc-35ee-451f-83bd-7fdc18dce660", "indicator--bfb84536-c848-4ecb-99e2-dfc0b0494156", "indicator--cb527c57-1a45-4881-b4cf-9c7222266563", "indicator--ef0aa436-e30e-4c7d-9b72-597aff51ba95", "indicator--847e05ee-07f1-4c8a-8108-4619764c9fdc", "indicator--2fe4049c-647c-4d43-a41b-ff82b3aa6b0b", "indicator--6f704e87-13ec-476e-b676-2e6e924aa7b8", "indicator--e43bb4ff-7659-476f-b5e9-8ad956d87d29", "indicator--10575f25-dc51-4c2f-a304-3b3a04ecbf04", "indicator--85711dc7-46a4-4fbb-a1de-34d399ba8fb7", "indicator--59c13e09-ee54-4db7-aa0f-fc69e067d45a", "indicator--37d1a7c3-4a82-45e6-876f-d051fc412ce5", "indicator--c3d4d44b-ac4c-48b7-89fb-74589980e8b6", "indicator--14d4f00c-87f2-4526-9458-7751a1c5774a", "indicator--2cd963f9-6807-4f11-8c0d-6ff3d8937cd4", "indicator--fe0eda18-7fa4-4f71-b08c-1ba1a45904f2", "indicator--b567a608-4a24-49f3-b829-3228f5f3bf87", "indicator--228caded-7e9e-4975-85e4-6682bf8e23e3", "indicator--6ab32c5f-b5b2-4365-9212-c2b9727f85dc", "indicator--824c352d-ceee-40d7-8b18-dcc17ce43213", "indicator--c238dc56-ef63-4337-bf83-45fdaf517473", "indicator--b31c533e-0037-4999-be01-0deb37c8e60e", "indicator--37217d0f-0afb-4746-9b10-f216035e2589", "indicator--110fa753-df09-4675-be1c-1f65f576f115", "indicator--6a7c2207-f511-4e67-b98b-d6260281b41f", "indicator--69e3ed1e-b68e-4d2f-b60c-c929e0bb3ad3", "indicator--dabe32a8-238f-49b0-969b-54816d24c2c3", "indicator--e2253fe5-f25f-41ad-b314-d60fd2207b81", "indicator--43dfd411-84ba-4600-85aa-2e29b7ba5aa4", "indicator--377871d7-0030-474d-891c-beb678543893", "indicator--cc319de2-c77d-4cf8-b02d-79cf2a35dae7", "indicator--3326a003-f948-4069-bfe9-95820462794a", "indicator--6e384208-8336-447f-8bb7-5a54c81f604a", "indicator--3bdfc120-84e1-48c9-8da3-00aa50b3692d", "indicator--a8d5612e-f3bd-4862-937f-bb4bda51c780", "indicator--4a8e79f3-37e9-4a3a-b766-49cdc2b40fe6", "indicator--906f8eca-0004-4d0e-a9d6-408f72ef89ca", "indicator--589b9ead-551a-4fb6-880d-2aecb84646ea", "indicator--13b09886-2e45-4a10-a200-9e2e60125e55", "indicator--d7385e8b-414e-4a67-b219-8f45a3cf7d54", "indicator--9193dd68-6f28-4cd9-88fb-96bb5907d0b5", "indicator--c3af5cce-3315-45e7-8b02-66d5fb5c5f44", "indicator--e8dd6688-9ac1-4acb-84a1-7f07150e6748", "indicator--8ac5c285-3059-409b-ac9d-316359c48ad3", "indicator--6dd9da01-7757-424b-8bfd-58fcbd0d7450", "indicator--c598a337-d5ff-4ed4-81ee-a1a399ae06b0", "indicator--3e0eca28-ff41-4727-9213-bb01a7c950ed", "indicator--63c9fd99-3a52-43bc-afa8-471e6af1ee3d", "indicator--5febbb1c-735d-4427-b4fa-f3d52a33ffb7", "indicator--92e0380f-f4d6-4b8f-b1f7-48e997d83278", "indicator--0b3c5031-4ee0-4cfb-81cd-6115ff099629", "indicator--c4f66fe8-7ed9-4581-a70a-319c6a373fb0", "indicator--469b6110-677b-4517-9e02-a6e00029127a", "indicator--650138d1-1dd8-4b0d-9347-f1a166d12e4f", "indicator--1bd16678-be5d-44bd-8de4-0f07240dbacc", "indicator--2a3ba5b7-67cf-4503-b2fe-69610fc1bbce", "indicator--08752711-67f5-47a6-9932-43ddc6d21d02", "indicator--b23ce3f5-339e-4771-a9b9-e0d558f1a2c2", "indicator--b5e754f5-a9b8-4ab8-b80d-de77f0b1be05", "indicator--88734961-e7e3-49e4-b5ae-837b3c965bed", "indicator--7e86d731-e822-4851-8237-848cf8cd6cd4", "indicator--7cebf8bb-692a-4b15-92d0-6acc862519bb", "indicator--2ecf6178-615a-410d-aae5-e6cefe115755", "indicator--3903bcfc-4c5f-4857-be35-2ff5c0c0d52a", "indicator--ffb963eb-e839-40e9-ba56-d3ac8a15b79e", "indicator--6e89b66c-1aea-4dc5-96e2-bd2ee7bc03e3", "indicator--e835bd90-9f37-4e2e-a170-beeb9b62df8d", "indicator--38cda3b2-ad47-4136-8127-338a98685537", "indicator--923b5bfe-1719-49a1-b256-76a4afe94fd0", "indicator--11f04b1c-a575-4398-8614-c9d9a1cab84e", "indicator--f3ed90af-c753-40d9-bbc7-a0fd3da22da2", "indicator--47666c6b-fafd-4c71-bcef-85e36bc08751", "indicator--46b0a3dd-bea2-4d0a-aaaa-e34da32af0fc", "indicator--2432bf21-2e94-4fd9-bd8f-3f800d2d8bb2", "indicator--23af2e08-fbee-4c14-9a45-d8b0c03022a3", "indicator--fb8b533d-4c5e-44b2-a6fd-fac32d475b30", "indicator--69cebfd7-445e-4447-b971-e0e6b62f59f2", "indicator--108a3103-ddf7-4231-b447-db908ad58b86", "indicator--cc932f1b-04d2-409b-8e0b-0d9d7472c233", "indicator--b49df34d-a6f9-4304-9641-879223739417", "indicator--56b51a08-2b40-4791-afac-bbc457e84a1a", "indicator--25f36c58-e33b-4fbc-8630-2c51bcd9693b", "indicator--89afe07e-2431-4bcc-844c-3401119ec562", "indicator--939cd52c-a264-41c1-ab4b-406e28bc35be", "indicator--2cc88550-081d-403d-8a58-2f5deadeb5cb", "indicator--95be7baa-981b-4f84-998f-cf42430cfc9c", "indicator--3b0bcf94-3a24-4745-997c-b71ac3040572", "indicator--8f57f90b-94e1-4c47-8d9f-1105768d72eb", "indicator--0a9bd56c-d9a2-46af-8f49-02133ed6e843", "indicator--579d6e88-a17c-4356-8b44-910557308bae", "indicator--b09638b1-c0f5-4d76-b12a-115c08daa548", "indicator--ccf72740-f48c-4542-ae1f-db7b8453fb53", "indicator--8263098f-69c2-45e4-8e89-faf2d0b8af21", "indicator--91dbeea3-fa7d-47d9-aedb-f3b1f36abfa2", "indicator--3eefcac2-4dcb-4fe7-8868-5d3004795afd", "indicator--218910ed-6c5e-4337-b77e-679002e3d6be", "indicator--1dc85db4-593c-4fe6-bf4a-ce561c4fd135", "indicator--1481f977-603c-4818-bdbe-3611cddfdc15", "indicator--7462af77-3131-4b2b-a685-4a49729f18f1", "indicator--4e4bdfc2-6558-4cb6-945a-50091786a318", "indicator--385c72fd-2b32-45bb-a69d-a2ef2cf9444e", "indicator--e7fee3df-d9fd-40bb-850d-650c5044718e", "indicator--15118ed6-f7a2-4fcc-96ae-0979af34c0d9", "indicator--4e06890b-fee5-42bd-a4ae-63b281ebb264", "indicator--d10cc391-520b-4438-b3b9-f3bbf30ee300", "indicator--e147e4e0-4eae-4209-9df8-a7ee2712d4ec", "indicator--fe5f7947-efd3-46ce-b6be-ae62b2b27fc1", "indicator--233862ab-ab5b-4daa-ab0b-2418c97a0014", "indicator--df469365-827e-45a7-a1b2-92f63c0c4a26", "indicator--38bb9497-cdd3-439b-a550-c99b6278f9ba", "indicator--81d3bb2f-22e4-434f-a6ba-6c664dfe25e4", "indicator--2fc1ef43-099f-4ad0-820c-3c0bf408f6c9", "indicator--af16ba2e-21e0-45a7-8db5-ca20ae82ced1", "indicator--9d210cc2-9fdd-43d5-8a3c-81ecb4cd79f6", "indicator--2213fade-d7c8-4b86-bcb7-6f770b0f0900", "indicator--3475efbe-3764-422d-b635-74b684c2433e", "indicator--4f966191-da34-4271-8fd4-85cf8b8463c5", "indicator--ef2394e9-1d0a-4b39-93ed-8ce52cb00737", "indicator--2fa4df8c-1e2b-464c-8996-7a23827c187a", "indicator--9a8398fd-756b-4727-bfd9-c24556cb69c3", "indicator--bd36f114-54dd-46d2-bf3d-d6a93484e4cd", "indicator--1267cb1c-c1be-4073-8c24-e39271ecc715", "indicator--39ec7d2c-6108-4d29-a3ce-e129925bb396", "indicator--2a2bfe11-94ba-4aed-ba6b-b0f0fdaf3b96", "indicator--e011c0d8-c255-497f-9de9-0a57a5df04b1", "indicator--d708904b-0094-4e65-a557-b940e0f4a929", "indicator--c727105e-9fb4-407c-ad62-0140239e1be4", "indicator--62e32bfe-4c95-462d-b22f-43aadf1a7f12", "indicator--b525e837-d53a-41ba-ae5f-6dcffcfb3d83", "indicator--600ac1ba-d8e1-4104-9d64-178005b0592e", "indicator--4324a72e-4cbe-4964-bd25-86e6597aefdb", "indicator--bc8a1c7b-f346-4b95-8b76-46429ff7d81e", "indicator--4c63e2c9-4035-4686-9c08-113e05fdd0a8", "indicator--2b95c8c4-a46f-43a0-b283-e5377ecea3b1", "indicator--fc70d760-7ad0-472d-a3d1-dee8827f5109", "indicator--06da88db-ff14-41c8-a02b-e16d291ca4b6", "indicator--325bc272-7cb4-4b96-b442-3608135897e7", "indicator--be0c48f9-29d9-4200-be58-358ea49009d9", "indicator--d6bfd32a-59a3-45ba-85db-a5843efb8a2d", "indicator--c3a73d20-373c-4337-aa7f-5c0cbb228ee0", "indicator--75acf9d9-0d2c-434e-a427-0e8687edd55f", "indicator--61ab7082-0578-4910-b4e6-d84c8d6667ca", "indicator--422b2394-2aef-4390-8611-fd2d610b4f3e", "indicator--42952854-e946-4c04-b62f-93cff94afcfa", "indicator--7c40e319-0ef5-4c21-bad4-2ba99dedd6df", "indicator--4f03bd7e-0ecc-49f1-b7b5-582fbbace294", "indicator--64fb355f-acf4-4375-a9b3-e8aaf4376476", "indicator--0415a227-e9f6-43e7-a65d-998553e49d3d", "indicator--8cf2de7d-934e-46c5-97fc-04a8e5e913bf", "indicator--9a10e406-1ebc-4067-94c6-cf5191babdf5", "indicator--65b03642-f90d-4052-b640-174982463c26", "indicator--6e460491-faee-4b84-8f29-ede51a616800", "indicator--d5456c0f-acff-4505-908e-b43440929e16", "indicator--03e357d8-3f24-4525-b96a-6be940dbfea6", "indicator--4103719e-cb9e-4c62-b196-fa92677d06ee", "indicator--22d7be72-ba97-4b48-94a6-de600ef9dc96", "indicator--fe5657bf-d641-418f-bf5b-71d381b5337a", "indicator--61ea615b-f928-41bd-ad23-b81fcd2f5f9c", "indicator--50a140dc-205b-4374-9439-f353e8f1c574", "indicator--5ddf2e1c-521d-4b6f-9089-27a222059e30", "indicator--4ec3a398-3c7d-480d-8266-c4ee7e4f4fd5", "indicator--d110060c-fc08-4ee1-a1df-ccec62dfd52f", "indicator--b9f9235d-2ef2-4093-b0fe-e2872207fd07", "indicator--4fe3beb1-e259-437f-8a25-ace764be999b", "indicator--bf2147e4-26ed-42ff-bcd0-a10524268b1b", "indicator--572ff091-e496-4566-acba-5e88f2f3a182", "indicator--4575cce6-c6e4-45f4-94fb-0294c3ee3fc9", "indicator--5b78d874-6c04-4ecc-a48c-db54f0e66f43", "indicator--b296870f-4d89-4859-88d8-84fa085e3063", "indicator--dd21821d-bec4-44f2-8693-6b94c4ebbe21", "indicator--99c540cb-ac78-4afe-bd30-97710d1c63d4", "indicator--3955cfae-349e-44f8-aa8c-29d9f966fbe2", "indicator--bbe5e2fb-6538-4de1-9e93-2d827c299d7d", "indicator--604bda63-22cd-4811-b809-4f9f688d5d13", "indicator--dc82b35d-5e33-46ee-86a7-12fd2ef9f5d1", "indicator--bb309618-2f53-4c9e-a7cb-b11b113cefe0", "indicator--ae14b51a-eeef-45c9-848c-25abde6cd349", "indicator--34b59046-e78b-4aff-8050-c6a13444825f", "indicator--196004f1-c3f5-4a78-bfbe-e2c14aa3f80c", "indicator--257cee98-9e55-49bf-8f70-6397b42eb164", "indicator--7905cb33-ccaa-4656-929e-4f80ff234e4a", "indicator--382a50c2-8acc-4075-8d67-0a9a6d2b10ea", "indicator--9434b938-8099-4211-b52b-e28e09b4f80a", "indicator--90b0bb01-a030-469a-aaaa-ce24e4606f03", "indicator--b9e79dee-0ce2-4467-832c-425e088f2cb9", "indicator--4c12093d-7aca-4067-b90f-bb5fd2ba9ec7", "indicator--149c15f3-1178-42ec-86bc-c47581363370", "indicator--0ecf34c3-5d44-4cb1-ae24-9cce52b5f588", "indicator--512937fd-e0ad-441d-9753-31e14f9c1df3", "indicator--45837ee4-37bd-4693-a120-31f933ff8a97", "indicator--74ac6b78-a2b9-406b-baae-83e1007a19bf", "indicator--5ef04804-8bc4-4ae5-93a5-17eb30f722ef", "indicator--49ba0c89-2a7f-447a-a4b9-8bb80059a1bc", "indicator--14e444d3-d822-4cbb-87e6-39907acd02ae", "indicator--ea97bf54-2024-4707-9998-04f855838697", "indicator--9cff8515-428f-412a-9ad2-4929f4eb9e26", "indicator--f9cb8e6c-037a-458a-8b1c-b8690101e47a", "indicator--6ba3c228-a2f4-47f2-8a8a-481bf183c8b0", "indicator--6faf630f-9815-4cf9-987a-c2d8d047cc8d", "indicator--1db15b9b-a656-4b7d-9bb2-a08307a1e5aa", "indicator--482c677d-de83-4d51-89b1-ac8139a4a0a4", "indicator--821cff8b-14ab-4017-8181-e25eef268bcd", "indicator--8a768d5d-99e4-4ace-86c8-6f1f0c6c22b2", "indicator--2e298fbc-35b3-453f-9bc8-6d2a2e0f4cd5", "indicator--f58502c8-04a8-43b6-86df-8ceee31d929e", "indicator--49750bc9-5a86-4e1e-892a-1fdfc87868b3", "indicator--f0f5a4bb-9301-499d-8cf7-ed40b537ff17", "indicator--3e19a214-47d6-477e-90ef-850b09439ab9", "indicator--4f954b62-1bb5-4ae8-b194-38cb178d6702", "indicator--91b7e5c1-de5a-47f2-a614-fac4f755cd66", "indicator--68d4c0b4-c8a9-4eb2-be54-ba6ec75ebd5f", "indicator--6ca2afef-87f4-4ea4-b769-61e9e7192742", "indicator--9a7b16ac-6b0a-4988-a9a4-af2022f918ae", "indicator--d09fca7b-0323-49b8-8328-30a62e7cac2f", "indicator--0a44a55b-40d3-47b4-a9e8-0539efb7dcb2", "indicator--0baa4ead-ba7f-4527-998c-a582a73507fa", "indicator--2a1ba108-1a50-42ec-926b-9ca0d7a125e0", "indicator--f11fa1cc-53b4-4a3c-89e1-88e3731ca08f", "indicator--993a3099-570b-4d22-8cb8-4f98ace3c665", "indicator--7973f2d5-0b81-459e-98da-89dd4240db96", "indicator--77484691-0c93-496b-a1e8-2c0010f271b7", "indicator--9ee27a38-5ddd-4c36-9bc0-ef7f97649fc5", "indicator--f6122950-0b02-4040-8541-7fce9c989af9", "indicator--35c426fa-6477-43c0-9afb-246b63d73429", "indicator--95ebc9fa-7fce-437a-8f4f-d8bf48ea1d42", "indicator--14194b16-6367-42b8-ad96-8e530d9b26e5", "indicator--b87c037b-f256-4ab4-a4a7-3ea1fa3589a0", "indicator--eafea9d4-c691-4312-bf41-e605255c5f5c", "indicator--13c1a2f1-7cea-4cb4-82d2-f942453a31d4", "indicator--112f3e71-2cc5-488a-a365-56adcb43b159", "indicator--9a2ff9a8-e22b-49d7-bc4c-1b24a1e80a83", "indicator--1ff43c14-60f3-4369-935f-645618ac1d92", "indicator--ede020ac-0e45-48ff-b81c-3e07b7c38b02", "indicator--fb653bc2-e84e-4a16-9031-0c1a4b843731", "indicator--2ac36a11-453b-4e83-84e9-32123c5c8838", "indicator--66fe3682-e8b3-41cd-a148-1d26d65c1a17", "indicator--4eab45e0-57f9-4aef-a9ef-8237e384b82c", "indicator--f3f06152-d8e6-400a-8956-0fb4dcc2be28", "indicator--b7337855-1d6b-445f-a569-c4dd786229ad", "indicator--a236d970-2003-4026-8291-5f46243a24be", "indicator--705e7b7c-b0ea-4d99-b429-7cb4ce448a65", "indicator--371f73b3-a95c-4195-8c49-7cf592be213e", "indicator--efe3ac4f-4a59-4244-8755-c02e117a1798", "indicator--5d25a27a-945e-466d-b226-18cecfb9424c", "indicator--4812ff73-81c0-4690-b420-fd903fed6499", "indicator--867d8383-41e5-4c70-8fb8-b0f8aab1c655", "indicator--4f1e49b8-0553-4e08-b90e-7865ec30a6ea", "indicator--1e31b52a-9dca-4bf3-955c-c362d8745a42", "indicator--71cbb122-f3f8-4982-910f-eaaf0bda4c23", "indicator--598d355e-3ca1-4732-a62e-6778cf04079d", "indicator--b1246a9d-2263-407e-a78b-7b0c908168e8", "indicator--a90559ac-9c75-40d6-b8d1-50702d0ce5b2", "indicator--35044278-78e8-4f61-8776-e98868d30203", "indicator--f1b42ea3-04b7-470e-ac1f-9dada6d344bf", "indicator--b9283af7-10a5-4862-a872-7b2936032aec", "indicator--246c8017-ba1c-4bf3-abf6-65d794f0e32d", "indicator--a071d886-a6d6-4a6e-9dd7-098f15614ff6", "indicator--abff7c83-39e2-4338-9725-3ed2cd542a28", "indicator--1ad4071a-1d38-402b-942b-1f7a9f990625", "indicator--8998ca4b-67e9-498f-a8ca-1bc7e02412bc", "indicator--da15afd1-5805-4eae-a9e8-b09101e8fb98", "indicator--70a756dd-cbca-4a40-868c-db3e374f359e", "indicator--47f4474a-8620-48e5-8cb4-3e0d7c18f00e", "indicator--7d6cbfe3-66db-4bfb-9ba1-2270f6b6e2e5", "indicator--bfd8cdbe-b7b2-47e2-8978-c419b3a28b3d", "indicator--7d6189d5-a587-4530-b99d-a7b88a4c860a", "indicator--945eb530-cba4-48a1-9ea8-6515885395c3", "indicator--4db7aa9d-58cb-4bb3-8150-cabd2841164a", "indicator--7d9f7797-e19f-4ab7-a603-18bb7e8c685a", "indicator--41345679-3edf-4acd-9f08-6de128c0319b", "indicator--04870fca-2117-4701-bd1d-690ada2c323b", "indicator--b9e2b26c-4cf1-4b2f-9217-c7c94bb78e54", "indicator--1e1b4738-a7c2-49e4-8dab-9230e3357123", "indicator--0535945c-388a-4dce-a4d2-a13c0d5ca672", "indicator--cd47da18-d1a4-4d20-b840-a8e00401c436", "indicator--3100b787-b6e0-496d-8728-f20528ea8687", "indicator--8bdee152-b05e-4c15-a87a-ea7d83802843", "indicator--41d361b8-46de-4214-9fac-9ed7da0a0fcd", "indicator--cdf13cab-938a-409b-8fea-1ee5002206d6", "indicator--ac888e55-62f6-4595-a0d2-e3718885e8fd", "indicator--a76f4289-7e79-4f42-849f-bb32a6ce9dfa", "indicator--a66c3285-accb-4d65-8295-d115cf47a3cc", "indicator--e31ed053-2a06-440b-a927-c336c1ed64af", "indicator--4f673968-8530-4b74-92e8-c484129265e3", "indicator--38716a06-b404-4355-9298-483cf29271f3", "indicator--24f9f3ec-d619-4317-a7a5-dbf6965d917a", "indicator--1b348f20-7615-464e-a031-a73f69dccfd1", "indicator--8b3881e5-e27a-4afc-908f-e047be67443b", "indicator--81bdd17a-66d3-45db-b4a6-48d46dfe8094", "indicator--00dc5638-2a67-445b-bd20-360ae3f097a7", "indicator--82cda69e-c229-46c4-b3da-4cfcd019fa32", "indicator--6f087f96-993c-49ad-b51e-9c80a9a6c103", "indicator--90c7c966-6f9a-46fa-aceb-98b628faccc4", "indicator--7fa570cb-66f5-4a3e-9563-c23f8c021e2c", "indicator--22996d9c-93e4-43eb-886b-20f9ee79de70", "indicator--9f5c2b6c-6bb0-4b98-abdc-eafe21c094de", "indicator--4a169ded-110b-4829-88a4-eb1532277d78", "indicator--410a1eee-75bd-483b-bcc4-5d2e26345bc1", "indicator--c6bd8640-847a-4096-a31a-26ca04076cf4", "indicator--f3be9b03-ff60-446b-affb-dbc75838bf11", "indicator--68d5f861-cc56-41b1-b2e4-f5302966a224", "indicator--8006b556-22cc-457c-ac1d-ae2136543f9f", "indicator--c07ea66f-0471-43a3-aaea-edb445bf5b4d", "indicator--77d2d4f2-9619-4bba-8b75-fb486a305529", "indicator--2b390b83-8640-423f-bd5b-501ab99f0ad3", "indicator--d87aba30-f839-4ac8-bc7b-286f816ee605", "indicator--12549516-955d-4049-a5e3-eb213568f3aa", "indicator--34067038-85b5-4290-bdea-50b30bd55d19", "indicator--254f8ad5-3c01-4adf-9c03-c605e6ddfdfc", "indicator--4d9612d0-f37d-42de-b7b7-8494ea3aa4d6", "indicator--5277a32d-f5d6-423a-975a-c9913ced195d", "indicator--103ba07c-60df-4e5c-9d46-83b808a15f49", "indicator--7c2550af-dc97-4158-af0c-b0baf193fd27", "indicator--40c5553e-1eab-4b6c-b834-6c05070442ee", "indicator--82b05e8f-dcae-4d08-bcc1-7d77bf4971f6", "indicator--06d30892-d6f4-40a1-adab-549bb30157a5", "indicator--7c547f14-f2b0-4e19-9bc5-2d4a0b77f277", "indicator--f2ee5db7-5f14-43b5-8049-a13cac703477", "indicator--90a1d79b-b32d-4516-9398-c9b70b80beaf", "indicator--11fd5bcf-8055-460a-96a8-96d707f87722", "indicator--e65c1a50-4860-4de2-8a4f-6f22968a27ca", "indicator--171050c3-a60b-41e8-bce2-cb31cea533b0", "indicator--1306e4da-b091-4567-93bd-a8eda732e21f", "indicator--706d8c45-74c3-4321-8bcb-d2ce0b1e50b0", "indicator--426e9a63-f154-47fd-bb01-dc8a0664db12", "indicator--eb309564-dbb0-4d52-89ab-4403339b66a0", "indicator--e7a318d2-dcc3-4bad-b8b7-f6910efb9611", "indicator--f205b68d-9a22-4d9d-9202-59f36d00374d", "indicator--f07560c8-6ef0-4d42-aa3d-f80df9f4b3a5", "indicator--dfb6ba7f-9128-4d72-8590-7628ea80d307", "indicator--0fae791c-2293-43f6-9516-e1363948d8ab", "indicator--9e9ea913-f74d-4b63-9948-449135f61e48", "indicator--aec13a27-fccf-462a-a44c-97dcc3c83ea7", "indicator--9378ce4b-e99c-4407-ad5f-3c34669b8e33", "indicator--b697be85-635b-4d1f-8b45-7f5f7bea0439", "indicator--f2718003-60c6-4179-b91d-bd806dfb2fa4", "indicator--7a23df92-64f9-498f-8cd7-c0897502376a", "indicator--875488cf-b131-463a-9b3c-203f0250739d", "indicator--bf4a300d-22c0-4133-8b57-1463a9d52310", "indicator--b5f8fdac-3ad3-4791-ba2d-a6ffaec6f198", "indicator--67787911-a9e3-4fc1-b252-7084a0c4bc52", "indicator--3314f63f-2734-4468-b98d-d5eacf91da28", "indicator--3246f1b7-de59-47d3-a176-bef73f667ddb", "indicator--8ba152b2-d761-4d50-a90e-51b794a6f32b", "indicator--3507b3f6-9024-4818-b9fd-cebd84c42120", "indicator--16031125-ad4e-44e1-b233-868781948a9b", "indicator--4e0cdc5c-fd00-4ad5-bbb0-e0fb3d91e183", "indicator--1680335f-6fb4-47b0-8c30-e622d937c68e", "indicator--2c0040b1-2dde-4cc7-ac5c-e5ad128c2a9d", "indicator--f9938925-b28c-46b9-a520-cd4a8a8263ab", "indicator--a6435035-5e27-466e-bd89-8e8edee48686", "indicator--ac5a7a29-e2d4-4b27-b299-c5466c14d5e9", "indicator--726fbcd0-a72d-4974-98cf-03f470452975", "indicator--5d03be4b-9279-4ba6-a4ea-788f412ae512", "indicator--44013d5d-9f0f-4421-a341-63b0f9584968", "indicator--46614ef0-08dc-4e2d-91a0-1536a48c7d33", "indicator--8838922c-92e1-4536-83b1-4bc166198a34", "indicator--72263ea9-60d4-4931-a4d4-55866b6bdb6a", "indicator--e31b5ab0-65bc-41f4-816b-80a15ee27310", "indicator--4cdf3f88-1757-48de-9c61-2dd15e8fe65c", "indicator--ea002e96-3abf-4cf1-8e23-dfd7282fe629", "indicator--2e4896ea-23f6-4292-b573-4559cb3a99ea", "indicator--b9e8ed6c-c827-48f4-8d3c-620a6dbfbc1f", "indicator--4ba8266d-64d1-48bb-8d9c-7231ea371c66", "indicator--efc702a3-843d-468f-8bf7-1c7fadec7b22", "indicator--0b997b1a-3332-481a-ac8b-627db735b731", "indicator--89b9f2f6-dfdc-48f3-8575-e528bb159e7e", "indicator--12de30d3-0744-4a9c-8486-d93dfd77d466", "indicator--4d5da108-6991-443b-99b8-4ec43ed76615", "indicator--3981bc3b-130f-459e-81f1-4eff74edcb32", "indicator--cbcc58cf-fe36-471f-bdb5-89c2b4560505", "indicator--a09a38c7-d02c-4039-b826-91e5189ad128", "indicator--711dbe0f-e51c-485a-a484-de82c99b581a", "indicator--fa6414ca-6172-4570-9b69-78815e2e966d", "indicator--603525fa-d128-4f20-a653-b8f06655cea5", "indicator--3adccce1-facc-430f-ab2a-6972182948db", "indicator--f957790a-0348-45e2-8e18-cfeb95f70e2e", "indicator--333764fa-37e1-4dee-88da-ba5567c37946", "indicator--c1bd3b91-f36d-4ba9-a70c-2d50f9df5512", "indicator--9519e8d2-7e53-4d2e-b8fc-a1c094528426", "indicator--378a3ac2-ad42-4fd4-b145-cb06b1637885", "indicator--af9ab249-0c0a-42c5-8fd0-842c0e3434b5", "indicator--31141320-fbdc-49f9-b35b-4a967dc4ffb0", "indicator--89c4ffc7-22a8-4f2b-9ccd-ec7d37760a5a", "indicator--6e1981f2-3476-4249-b9da-f75a3c472a44", "indicator--c433a025-3a43-4cc3-951b-813a2c0f5334", "indicator--184315e9-8149-47b4-8fc8-b462d43542f6", "indicator--a18ed007-3440-418f-b8b9-a46dbbb787b9", "indicator--9f441721-dfcc-4e73-96fc-9b72fcf5422a", "indicator--51dfcb08-0c36-41cc-8ff4-fb720c0a698e", "indicator--8c766a91-0695-4b2a-a390-c890741287ce", "indicator--9a2ca3d7-c9d5-4f86-a44e-d13411b32466", "indicator--c327c2b2-d734-4e8f-986f-9e0ccaabd2ac", "indicator--d2469f16-d5ee-4636-a1d5-c5de15077c0c", "indicator--95f92fa0-af6f-439b-95c6-f09171a1741d", "indicator--2ebbe5d8-173c-42d0-8dcf-a1f979129195", "indicator--758b511e-2750-4c0f-af5f-5aa973f345a2", "indicator--20ee6028-caee-4e57-ae1f-8e2c9904f9a5", "indicator--85ffb749-f319-4e1d-8350-b8ff5bd90c39", "indicator--239e9645-bc7b-4ea2-8146-000933cfd50b", "indicator--43d28a1f-3dae-4438-a1dd-f5ca805ddef9", "indicator--9ec860ee-546c-427f-857c-3d370166c561", "indicator--bf9753f0-6206-42e0-ad15-9930d0840a7d", "indicator--c3a944d1-fb37-426b-8408-5de32f1f2780", "indicator--2443762f-b4e4-4720-bd5c-a614c637d4c3", "indicator--e731dd54-a915-465e-aa12-726c1c5bee91", "indicator--f1ac26f5-70d8-4916-8123-7793d8471245", "indicator--e79b75eb-84df-42d6-8896-38ddd67f003c", "indicator--c8554c4a-d2f4-45de-a1bd-eca90d7d8193", "indicator--3328d2df-bec8-4d0e-b614-d8fbe6142ebb", "indicator--ec29d8f3-7fb9-4172-bb7c-f041b1e9f55b", "indicator--a5407db4-bc98-4c32-b2ad-84b747ab7549", "indicator--8b712bdc-2a05-497f-a309-6f0e3487b16f", "indicator--0d18aed4-cf49-40eb-964e-b3d2a4251870", "indicator--17f06132-afbf-4cf9-98fb-724258095704", "indicator--7d63ef97-2c2f-4a53-b3de-f8c61f73fd3b", "indicator--a1fbda8e-8eb5-4b5d-b13f-ab553a5a5ced", "indicator--313ce7eb-10da-44e9-a545-2ba889da746e", "indicator--06a4692a-5857-4e55-8bb3-c06c30e6c567", "indicator--844eab2f-93ed-4544-9391-ac0ca9f1b768", "indicator--f3fe6f66-4a33-4b28-8373-e87360eb1333", "indicator--d1377c81-4b3a-4f08-a35f-b8a75b2fe68d", "indicator--3f7c50ba-d2fa-45f5-a37c-19230aeffaab", "indicator--2e4a28b6-b2a0-4619-b3a9-c0940c9a0fe5", "indicator--ff084655-0a38-4972-83df-f2033be2d102", "indicator--4e1c2e8b-0c99-4641-9ac1-f3fae4a737e5", "indicator--8335905a-fa7b-4f2d-8676-822819af29a9", "indicator--65cc60d3-6ecf-49f5-a203-36e0e1372f7c", "indicator--bcc9e3f5-d640-48a8-84f9-18ade6737c2b", "indicator--3da4ed72-ee0e-43b8-90ab-7be69f21507f", "indicator--81ae05c5-aa44-4c55-a7d3-d8bb0808efab", "indicator--9907f256-d56e-4742-a3bd-06a2e6bae714", "indicator--d382585e-2d59-41cc-9c8c-a9ec58030d5b", "indicator--5d09db3f-3ffc-457c-8acc-977d654850bf", "indicator--057ce287-d6b0-4235-bf95-960348bed54c", "indicator--3d7efbcc-ad8f-4fdc-8f42-d4f8f9e2da42", "indicator--8c55ae2b-73c2-4a51-b691-74d68690aac8", "indicator--29a02692-aaff-45a1-85e1-828aa45a9c91", "indicator--ee0777fe-bb6b-48c9-8a79-fc56912de96b", "indicator--abbf8c4a-764d-4467-a2bd-a00c48a88c90", "indicator--fa59d795-6360-465a-baca-2de97de7b9d9", "indicator--8911da87-e8ba-4368-a1c6-42ca7d4b6c99", "indicator--01a46169-13f2-4047-a329-fbfec5a075a6", "indicator--dc6f9b74-43e8-4a2e-af6a-5f416fdf416a", "indicator--fb3896df-0e2e-403f-ba0a-7f72e5a279fe", "indicator--1d7a31ba-a3de-4fd7-b0e8-26aea50f1c96", "indicator--08a6e2e5-ac15-44ce-8c71-dd3a86cf3808", "indicator--0ad61ca6-c1bc-487b-9f30-704d4a5e45f3", "indicator--5c2807d7-3c13-4e0d-9c4b-8a635e61eef4", "indicator--ea7815e4-44ba-4dd9-8edd-71badab7273b", "indicator--64320a4b-4526-46f7-b89d-b1acc99c6813", "indicator--65c96377-891b-41be-aeb0-75444f4c5fb3", "indicator--4da14a09-4e6b-4026-b2d1-2406272b648b", "indicator--eeaeedf0-c2e6-48e6-b88d-6c262155a7d5", "indicator--30353017-3bb1-4a3e-a9ab-b59ee5fd9420", "indicator--0539f11b-e12d-4dc3-8f43-1572e0c7d933", "indicator--29ce4aab-513d-436d-8dd2-316ef41f54b4", "indicator--86b0ff95-3099-4077-bdfd-5369737466e3", "indicator--8df67fa6-1ad1-421d-a8e4-3da3b9c844ca", "indicator--7fe81b07-2e20-4ab2-abad-6e169c5e87db", "indicator--bd6eeb7b-4621-4459-8e5a-05661589d82f", "indicator--d9942b1e-63ac-4796-a10a-a7f27f8ad075", "indicator--7c926194-75fc-49c0-b15b-2e6d550604b1", "indicator--0ef4cb23-f9c5-4333-b89c-14d89e8430c4", "indicator--1281849b-e579-4357-ac7f-e9ed3982db29", "indicator--377f8d1e-5133-4f16-976a-b77b4a674305", "indicator--0a6f2150-bb2c-4362-8419-4c08948547de", "indicator--d909d259-a82f-40ce-9fa0-011b73ec7f84", "indicator--7352c769-9901-483e-89aa-a786522cc254", "indicator--86715198-6e3a-4194-ba3b-13268ad1e5fb", "indicator--e6f68dea-dd08-4ddc-a3ae-cc6bb059a4d5", "indicator--4a51e089-3a2c-4d59-963d-a222a75164f3", "indicator--4d78cf30-e283-4cc3-b871-61f9290da45b", "indicator--f51d7853-c698-46f0-81fd-fa01c80ce1e7", "indicator--e3a98b0b-3954-43d6-ab7b-cbbbbb61d1f7", "indicator--c803af39-9a5d-459e-8af8-1acc641b17f3", "indicator--cd8eeca9-05db-4a39-8058-f619116fa323", "indicator--6127e2c2-70e2-4666-ba9f-c30cf1b3e468", "indicator--12ba9d3a-2a63-41fa-ba3c-d489d2dee0ba", "indicator--8a38f575-2d33-459a-96e0-700b157e3d37", "indicator--56359b45-2479-45fd-9658-e1d651798095", "indicator--bdb5b4aa-45c5-4668-8b43-4f6d03d42937", "indicator--2e20114f-24e1-41c5-b30d-82a6380f0271", "indicator--d85332fb-3e3a-464d-88a5-95a1a526c1e9", "indicator--03e4b209-3834-46ba-8d35-3f1f8986369a", "indicator--d9e6da6d-7cd7-4268-b75d-74acd559254b", "indicator--40303641-462a-41f5-9e91-5e273bed167b", "indicator--45097a6d-673a-4f1e-998f-e9a6fca99be1", "indicator--6b92af4a-0ebc-4f19-91e5-ebee9365337d", "indicator--78411a28-3c4c-4434-9434-18cd27aea007", "indicator--a4b0f376-c90f-4ef6-b521-1b0143ec9feb", "indicator--d791f593-1ac2-4378-8796-597f8f1e3b49", "indicator--57029325-8a60-4916-baf2-3f666fc76bd4", "indicator--6154bd55-f2c0-4b21-b580-a5db049b349d", "indicator--8b3d6fe3-36e5-42ee-9f40-c652bed167e1", "indicator--c8ab8e2f-1d61-4cd0-8d8c-433b7b828aac", "indicator--dd4e5a95-211b-49a7-a7b6-7e7f6af50af4", "indicator--95282ba4-5cc2-4cb5-94b6-7c913c4a17a3", "indicator--616c93d6-e21a-4ddc-b428-21df5bad5318", "indicator--cb8a06bd-0600-4cee-9065-ca83ecfd0d8f", "indicator--2fd6d128-a282-422d-a9c5-e3d9d5a18d77", "indicator--cc9ee02a-ef8f-4d3d-9982-84d765045e08", "indicator--109db7c2-65e8-430a-aa9d-65d29f1ac508", "indicator--d434ec1b-e064-4b67-b866-4bf0df3c1ea1", "indicator--9e66d25e-673f-49d6-842c-9b208290d98e", "indicator--3e23abd6-f3fc-4c49-9a8a-510e61babf33", "indicator--0d4aacef-19b3-4bfe-be36-423e7e371545", "indicator--237463b4-f620-4d05-ba21-014706e4744c", "indicator--09d386f2-b58f-40d7-a6c8-87c456bcc2a2", "indicator--c0de540a-f7a4-49c3-b713-e1f86192bf25", "indicator--1f773754-bd6e-4918-820c-412533d77cc0", "indicator--ac0b9a30-c171-4a36-9028-7bd480ab798b", "indicator--5423ed47-5d88-4f78-ae2a-1c4dd4d0ba8a", "indicator--40db1085-22bc-4f86-8ced-aff2a491fcf2", "indicator--712f3b48-809b-42be-be15-7f2a513fdc78", "indicator--4197dd2b-cce1-48ef-9034-f8a4b4c38874", "indicator--207523eb-174d-4b51-992d-cd5b85305b8d", "indicator--40d89095-616f-4689-9af7-dfce162b6440", "indicator--6cf9551b-0864-419e-876b-27888f33b8f9", "indicator--04c120aa-15de-43f6-9c1b-91716227c5de", "indicator--89125dbd-6c0e-45b3-aecc-5d9d173e6552", "indicator--6de79edd-f17e-4cf4-a4a6-ee3f19e96f62", "indicator--3bd7aeee-b9b3-49e1-b11f-16f63d89b3f1", "indicator--432eca66-303d-43f3-b359-093bbd85c5aa", "indicator--bfaed737-1518-446e-9a7c-124a2be6aebd", "indicator--9a2ea5e0-cc0e-492a-87e5-5abeb44abc0d", "indicator--f0c0b3b3-0814-4c57-933c-795aa1f6e023", "indicator--7011ce3e-b527-4609-b923-6604414f3a41", "indicator--3fdbd434-08db-4397-aa35-d37d27689a15", "indicator--618598b3-ba78-4e81-97e5-9dbd7de328b6", "indicator--ab49cb06-d07c-45ff-b53c-81eb29da859a", "indicator--d9ba3619-65b3-4097-928b-4d54bfc6067f", "indicator--f0eeb224-59d2-45db-81bf-aaae3e10e841", "indicator--a4f36934-b627-4509-b898-dde0d2d9324a", "indicator--37e04868-5a12-4e37-83a4-c5191dfe2e2c", "indicator--04bbda60-52a3-4bbc-a32f-41affa830d0b", "indicator--adfb81b8-299c-4bb3-b36f-c68f380d97cc", "indicator--4c129b76-457e-4530-ae9f-b8dc3eba4594", "indicator--70198af9-f87e-4c0e-93f0-bd570092a430", "indicator--6a4dfef4-f12b-4393-ad9d-5bad61223943", "indicator--bae7cfee-d7b8-4c84-9273-43ee320636ca", "indicator--23f1a140-5440-477f-95f1-403649dab0e2", "indicator--dd4ef77e-2dec-4e4d-a8cf-bd30e34bb0fb", "indicator--b9a0c9e4-9abf-432f-90c1-86e888081ce3", "indicator--54c8ea72-4578-4bac-881a-ce80d990a35c", "indicator--56db51c7-34ac-4ec5-970d-fdbc29533da4", "indicator--7279f34f-6da7-4e72-a188-ed7e98d6a2db", "indicator--87281038-c9f7-46ab-a2b8-735a7d0d7d99", "indicator--6d0c3d78-83b0-4aac-9ac3-b13c2dfac3b8", "indicator--0530da0d-0af5-4fc3-9a23-c538bb9551c8", "indicator--d32722d0-e45f-4268-b259-e6527acf40bf", "indicator--929a099f-a9a5-4739-a15d-48f1a0d63330", "indicator--0a61cdd7-e30b-40c3-8693-6ae7308b8f59", "indicator--97ba0c9f-902e-471b-b21d-87ceb1000765", "indicator--5a198777-4707-4235-a80b-979a492a6e90", "indicator--cebcba01-648f-4e89-a2fd-3e1d741c7c18", "indicator--0868663b-13c2-4b07-adcd-76280878991e", "indicator--1b597f13-4e46-414c-a495-be040f0b3e4b", "indicator--bd08c839-03a6-49b9-8c2b-48094ff248e9", "indicator--6d2e1eb8-dae7-4695-a1fb-a430044f4978", "indicator--9678a8c3-b8fc-4ea8-a437-9de34af9b1af", "indicator--73f169a8-a384-4b54-8b68-b892564faf7f", "indicator--1ad33e4f-e267-411b-8aab-4556646f2b64", "indicator--8b1d89e6-0e4e-46d5-8041-ed565953e47f", "indicator--c9323400-3a19-4c34-8df4-56d777e90488", "indicator--07ab099c-308b-4487-8a70-c0978a84d885", "indicator--629d2d94-f1ad-4058-9d5b-73aca7c8f789", "indicator--72aa47fb-e541-438f-abe0-2e457534a500", "indicator--ed3bdbbc-f989-4c46-9b5c-999a1ec7c45f", "indicator--8733db05-86e8-4204-a960-b14fa2b8cfc6", "indicator--b5ecfccc-9c2a-48b0-bcd5-eb501b76958a", "indicator--c355df84-c1ed-4053-b2f4-4194d623e6c9", "indicator--7c5aa794-9808-440d-b7d0-39229bcf0b3b", "indicator--a1c76bcd-74af-4c81-a7b9-107a5025bd20", "indicator--3a396963-7b17-406b-b1c3-d218b4b15144", "indicator--ec324d17-e00a-4ad0-be89-721aa3be3d86", "indicator--96290ec3-0286-49a8-b82b-f43ff3b2b278", "indicator--79335def-42c5-4b25-b0b4-4890eb825419", "indicator--40d81562-b529-42b2-985d-336baa2ef754", "indicator--600559f1-ca47-462b-a1e8-ccde2f2dc921", "indicator--f02d1e61-6d50-41a4-bf60-4fd25868efb6", "indicator--dd2de106-0b1d-4c0b-9e24-c69ef17e325f", "indicator--84c7d7bc-805c-4332-b71c-f1791d6821a2", "indicator--862b9d0d-c55e-4597-be7d-a968ac48a71e", "indicator--9677b7db-dcb8-496e-b400-12f12655681e", "indicator--5d288fe0-7d7a-4752-9e04-c12977e18524", "indicator--5494013c-f340-435b-b1b0-61ec263597f3", "indicator--f39ffaba-13fb-4b3f-b92c-17078cfd8ff1", "indicator--302a6068-a809-4111-b623-0a915754274b", "indicator--9d761588-9bac-4977-9fc5-ed464d22a07e", "indicator--9baeb7dc-df64-4a68-b7c2-63b0665949c0", "indicator--b3011441-c104-4e18-923e-2b0627a47838", "indicator--082d903e-3ca6-4f20-9fce-4d977b8a3d05", "indicator--1fe3e60d-f798-41ca-b79f-562286290357", "indicator--938f850e-276f-45ef-8e74-e7ba3fad9f15", "indicator--15b4808d-9b64-4b99-9e1c-f3e83d36f5f8", "indicator--770a7b08-4481-496c-9e40-ca4b9545f729", "indicator--7ff82b4f-6121-471a-903c-692be5fded6e", "indicator--b37c85fe-663d-4312-8d9a-1c8447131026", "indicator--33e05055-65d3-414b-bb61-ed526ee8bce4", "indicator--7a44d3e7-b6e4-4a9c-b269-676f62853cce", "indicator--9a0d9373-9173-4d82-9d4e-35dd212d0a4f", "indicator--ed56f7a5-e74e-4d3a-b9a1-60b0b35c8b68", "indicator--d030ad4d-741b-4008-9fd3-9d4b4a8faa5a", "indicator--60a282ae-acdc-4ec6-a049-4e23462609a4", "indicator--a578a828-dbb7-4a9c-9e57-b9203f4ec1c8", "indicator--c7cec032-0d63-4608-a310-1f3f6b0e9832", "indicator--0fed6088-df83-4426-b11d-457a66aeae29", "indicator--bc7efb9a-d39a-473e-b3f2-03159a5d8e77", "indicator--11303bb9-e60c-4d30-a28a-d81ab628ff87", "indicator--b97ce76d-7489-44a6-9879-4a1881c4edcc", "indicator--4e6dbae6-6107-4f77-a071-871cd72be908", "indicator--27854030-5c85-41de-a710-fbeffd582c69", "indicator--06f56f46-5d27-4c4a-bbb0-a54154bcb123", "indicator--63c18c8b-7939-41ae-9a24-25c7bdfa1a0d", "indicator--d077a8b3-52a7-48df-9e8a-88143d49d1c5", "indicator--0f1ce034-c2d2-4740-887a-38def563e047", "indicator--8209674f-5768-485e-bcb6-14fbdcd2a2df", "indicator--d9f642b4-c278-4505-9267-1bcd2360b85d", "indicator--e6d788b5-f0f0-4a65-8432-3b550e8ef231", "indicator--8e374a3a-243c-49a1-abfe-4c3b0c4fdd8a", "indicator--c6ef85c6-50d9-4f8c-9fcd-45d2e0d54515", "indicator--cf731525-2df8-433d-95d9-5b1c86760dd3", "indicator--2f2e084d-bb33-4ba7-989a-76772d5a2099", "indicator--61e4b4af-025d-4671-8d73-410fef9cc686", "indicator--4ad05bc2-ea85-4e4f-af3f-0d96ee03ae39", "indicator--eac6ed03-060f-4388-bd5c-9980d7c7ec65", "indicator--b29b888c-8d8e-4aff-a335-640f52237661", "indicator--57f299c8-fb75-4edb-8a33-1e72f93741bb", "indicator--a7ec3de5-bd29-486c-aea9-15fbbf9fba5a", "indicator--a788ad27-a47e-4f00-8eac-98b98d9d7233", "indicator--364a0984-904a-498c-a6ba-bf6165c36742", "indicator--d245effd-30eb-48ce-9731-af8fdfd7d480", "indicator--12a10f8a-a30c-4e6f-8c9a-ffb9e3eec849", "indicator--50a5a07f-292d-47e7-bce6-04d35063eb88", "indicator--75e6ff30-94f7-42db-a740-b5780fe7024d", "indicator--4e90593e-3b62-470b-ba36-ebdc320f82cb", "indicator--ec4ac249-c253-4bcf-930c-5443eb4507a5", "indicator--9b0bf751-b350-4913-949e-9eca1cf332a6", "indicator--04554756-8478-419a-b327-a5ff6e70b949", "indicator--0c0c6be8-7b72-49b1-815d-65f0b4b99a28", "indicator--b44312a4-a257-4a9b-be66-cd0fdcd24e88", "indicator--ec89fae1-488a-40e9-94be-4b8dce763064", "indicator--03ea455e-5512-44e8-b56a-d0a02b1dd08f", "indicator--679d695f-6d69-42fc-87f3-22cbd8ca7a8f", "indicator--403be310-214e-4004-b19c-7756e07a5e2e", "indicator--2279a348-6b47-4336-85fb-c68716daa348", "indicator--fbed34e2-5d07-4702-a964-ecc031e5a95f", "indicator--210adc39-c44b-4296-bcac-ac4845fd6e15", "indicator--eba51841-a48c-4baa-9771-380e68742b99", "indicator--35f6bdc3-aba5-45c8-898f-619779243167", "indicator--482a3f71-bd52-4400-bbab-39049ecf7aa9", "indicator--c87c4e3a-bbe7-42a6-993f-c38d503e0495", "indicator--271e911d-653e-4205-b960-56062ae96685", "indicator--84839620-124b-4c6c-8fd3-90469663f659", "indicator--ab05f159-6291-48ca-89f9-38698b714157", "indicator--92ee5821-d0b3-45bf-812b-bac507be771d", "indicator--3bcff94e-7b37-4e10-a1bd-de2e4eb84068", "indicator--84eab66e-2197-4170-a8cb-45e761d68d2d", "indicator--319a5214-3bdd-425e-b480-8d39524751cc", "indicator--7e9bec6b-92d8-4f29-874f-e23d09c4d3de", "indicator--113787f4-f86a-491c-843f-64db46e40f8b", "indicator--9289fd0d-4751-4444-a0ec-fb00ca57a0cb", "indicator--d8c19c78-2b52-4470-bd9d-04d135a773d4", "indicator--c61e702c-88d9-44ae-aed0-f3eb3ddbdb30", "indicator--ba8ea614-4e26-45cf-97be-7cb0c972aa4a", "indicator--5f37d99f-a14e-4602-b2d0-3338bf6e0a5c", "indicator--c0620b7d-80bd-4b13-bd0f-7cb74d7b45aa", "indicator--c46ade62-6dee-48d1-9746-e7e1038177c0", "indicator--4c0d6883-74ae-4c6c-912c-dac00e9b2bb1", "indicator--5b5df6ae-be1b-415e-aebe-1e94cd030e84", "indicator--4bd806ec-e23f-4270-8cc7-7aa6235af23c", "indicator--0e1dcc09-8618-430d-a12d-59e1810f1526", "indicator--92f9735b-d765-4578-9583-b163b7559225", "indicator--e72cca97-837b-4fe2-afd1-2ff3434a781b", "indicator--751aa984-3e4d-48f3-94d1-15cc44310085", "indicator--1aa3202b-fbaf-4d88-aedc-5288e2ab993d", "indicator--a3ced762-3c14-44eb-8994-98af9c229b40", "indicator--a1e49654-7a8d-4433-bafc-ed8d35a7af23", "indicator--51bac319-b443-489c-b6c3-2bc4298a85b2", "indicator--e916d454-0cd3-4b84-9264-43cd945e604f", "indicator--99ee6d3d-72f1-4d72-9c98-7ec6ec441cd2", "indicator--09f39647-a377-48aa-9110-43210aad0b32", "indicator--2e27025a-39c9-43d1-81d3-38524b6d3c3d", "indicator--8458ddac-c071-4e2c-89e1-c4681c9107af", "indicator--5e70529e-ce8b-48a3-98b5-f4d4a0d5f74c", "indicator--975f8008-f487-4bf3-8db0-b0d8b629be9d", "indicator--8a9e1342-6c99-43e7-9a71-7257f66059d3", "indicator--b0b0b7d4-8b90-4407-806d-08542999637b", "indicator--f117c325-275f-41f3-add3-e174580117b6", "indicator--3af74087-03da-4998-baaf-d52731ed6cf2", "indicator--cfce7bb7-8bfc-4cb5-84d6-83075332f95c", "indicator--e679d104-d720-4cea-88e3-541fc272b569", "indicator--7527371d-83be-4521-9c84-043550b81dad", "indicator--34324676-596c-4f09-b31c-09d2a83e5112", "indicator--9437c3c5-7c93-4f58-b960-e8f00c2a37d1", "indicator--abcb7447-9374-4352-bff6-0709624cf069", "indicator--d0367e1d-038f-4e7c-b9e1-7194c86821fd", "indicator--baab8cb4-cf09-4427-847f-18b6c3115c7a", "indicator--a25869df-0bf9-49d8-af0e-026500a857c2", "indicator--a587da14-71e9-4845-a719-d171e8449d1f", "indicator--00fd6de0-7584-4205-abf9-4d8f636a1a81", "indicator--39ecb842-0fa2-46f8-9d9a-dadf5976bd05", "indicator--fa1b7163-399b-4fe0-9b67-93476333badd", "indicator--ef3bda02-0e4b-4e7c-be0a-8c172752d124", "indicator--41fc7a0d-0ec8-4494-887c-385e4e2c0d0e", "indicator--8580120a-4195-4ff3-a6a4-698b28dbb35a", "indicator--bdbeb9a1-6426-468b-b00e-9c8e5a975aad", "indicator--8f5eadad-2022-410d-b5dd-957439fac01d", "indicator--92b00ff5-4b72-4ae7-9c04-03ca1d6dff30", "indicator--1cfa4b03-7d03-4e2e-ad6c-f6f681136275", "indicator--a7b6301e-a38c-4b74-bc57-115bba7a6d7f", "indicator--be700a1a-ffba-40e1-90ae-50fb3a33a775", "indicator--5f70b4fd-9650-405f-9979-0db229f33232", "indicator--e04e6986-96c0-4ba6-abb6-98545e17743c", "indicator--0e843c4f-5329-4ab6-b9e7-b72f62155cc2", "indicator--108e0cc9-d88e-47db-ae07-e758c4dd20cf", "indicator--cf3dfb1f-0475-4714-9190-70f00f0d1a46", "indicator--5a065fe2-83f1-4a1b-93a1-895ceff252a8", "indicator--0a28f7f7-8837-4e7e-9423-272f38ae0adf", "indicator--5771f642-157b-457e-b3ee-587fb9153a85", "indicator--b153ae21-9d82-4d4d-bdf1-500d24958db2", "indicator--1d8d2de4-6a6c-49fc-9da2-eacdae489652", "indicator--4133b140-8958-4e56-8fb7-8c59f8706e30", "indicator--f76f1660-29e9-47d8-bdc3-e01787b05c47", "indicator--c6629f8b-ba13-4c7e-aab0-2a84d1d0e420", "indicator--85eee3f3-d4f2-4944-b777-6298246f8273", "indicator--79dfa506-806e-45e1-9b85-bee61622b345", "indicator--c4a16823-0a38-47aa-8c11-e72b55f7e790", "indicator--126a3afd-ba47-4737-9876-5cc103115f82", "indicator--b394dc04-65a3-4cd7-aab9-9c625de91147", "indicator--0bafc46f-81f8-4d77-9b09-2f9c7f80cb8b", "indicator--3cd0ed03-1dd3-4f40-82b5-740b66479ff5", "indicator--49a0ffb9-5d28-4083-a6d7-34075fd6f1dc", "indicator--da21d6b6-adba-4c3d-83c6-ea3a6e9829bb", "indicator--473c916b-4aa7-4789-9bc2-547388b3b9b2", "indicator--428eed41-26bf-4c98-8e31-0f7f27d977b2", "indicator--65cb5447-8594-43ce-9c8b-d68ea293f924", "indicator--f272e78f-4ed5-4131-b906-2de2ca192ef2", "indicator--66d0d25c-71d3-4547-803e-c9e2126cc4ea", "indicator--e8f8f2fe-0c36-443a-8ab5-1ef4a72e8a61", "indicator--210a5885-06e6-4aaa-b8ce-3991102a2d71", "indicator--aae503fa-d0c4-4648-ab68-5f5472143704", "indicator--199bfcc7-1688-4de3-b0d4-86d4823fa94a", "indicator--c7d4e0c4-8656-4c2e-a2e2-e060b8da6e16", "indicator--5a05156e-1f6b-41c1-b7b7-9b7c2f711b74", "indicator--5602b73f-237e-4ea5-a5de-84de9cb8c9bc", "indicator--e84aa6d2-65e8-41a4-8212-f2de5ea0cf8d", "indicator--343d2757-9506-4bbd-be1f-bc4cdc6863fa", "indicator--091310a1-65e0-4780-bcc9-5d1d39e26f61", "indicator--272bfeae-cdeb-4058-89eb-c9770c1a493d", "indicator--dde236ce-694d-4a38-83ec-832ad9a07aa8", "indicator--61e8760e-3b8a-4b62-8bdb-d8b43c5806b3", "indicator--f4ee9d39-4823-47b2-8757-cb40e21f2f1c", "indicator--58631ba0-5d45-4bd9-b3fa-b89b53dce6cf", "indicator--63205bdd-d2b1-4a66-8965-4a3b5bcb8079", "indicator--beaf5391-a95f-46cf-b305-4993c1a255a7", "indicator--f39b9b8e-9a9b-4195-8b35-26d0564704eb", "indicator--13123455-72e6-40d3-a040-7ed3e400b53f", "indicator--198e98d2-c3ca-4364-8d9a-19376522dba4", "indicator--68002c52-9125-41b4-b671-42497f31bf57", "indicator--69ff543c-95cf-49a4-a451-90436bc83b35", "indicator--f614eeaf-8fe5-4cd7-b58c-2920a9d99b4c", "indicator--a7f680c7-471d-4846-b56d-f45d3b40718a", "indicator--aa113a42-3e59-4b71-afe5-6735daf201e4", "indicator--d5e0c5cb-11ec-414b-831d-f3b924ae494c", "indicator--7d3d3c7d-2193-49d6-af9b-763f71daba6f", "indicator--34cd49de-245e-4537-9551-04845468f177", "indicator--29c6f9b5-0360-4767-b629-a22bf1a3ded1", "indicator--65f0d1b2-5c7a-4443-b63c-9c0f05b4a49a", "indicator--6f84bebf-a806-40d7-8349-bc5b3ae574f2", "indicator--fe650ff4-f7a6-4ebc-81ad-890eb5aa12e3", "indicator--e04427ef-01ac-4959-9d96-d72d8eb757fd", "indicator--0925e459-9655-45c8-bcea-9d9e244796fc", "indicator--ca39ef50-5d2e-4457-afea-b30b2de1eed1", "indicator--0ae6f2ca-d219-4da0-aaf1-2ce770a506dd", "indicator--bdee2e53-04f6-45f5-808e-ec1992054fa8", "indicator--d77593f9-1728-4129-9255-70ae6194486b", "indicator--7e9b322c-502b-44bc-a35f-16515ccc185b", "indicator--d1ef0c80-5033-4e49-b3cc-57d8c5c7abb7", "indicator--c5d11a41-d525-40a9-80b0-6452242e9561", "indicator--b88eefcc-0b6f-46bf-8011-b3cbbd443edd", "indicator--a7ab427f-34c7-4a26-9107-0dbd64070c62", "indicator--a4b2efd5-5e74-4292-8244-ce087ba11db8", "indicator--4b4bd5b5-e5e3-4418-9fba-c99abc7068ea", "indicator--bab78e5f-b39b-4999-a298-72037c5a13c0", "indicator--e8ea99a9-50fa-4fac-af1d-fb0110c51169", "indicator--9aeb34d8-2008-49f6-bef1-ae17fa308b2f", "indicator--3954beee-3851-45f5-9d89-77d5397c94cd", "indicator--e9082a38-3430-460c-86c8-66774b5f1448", "indicator--a362f2f7-d9e9-4119-93c4-ca51bc275fa4", "indicator--9175c65e-cfbe-47f4-a798-3393d8df1ac5", "indicator--3ba05bc4-68d4-468c-a76b-1d8d99a0305a", "indicator--1924ace4-8604-4230-87c2-959282a8130a", "indicator--02d6088a-7fad-4e09-96eb-a1515e3f4be9", "indicator--dd09fae1-244c-452b-8e39-16d37d8e70d7", "indicator--b66f9c6e-ecf2-45d2-baac-23cafaa8a3bb", "indicator--1f5849a1-9ab4-4106-bf4e-c6598f6f8702", "indicator--3eaea36b-6e77-4f6b-b881-318b4e101e1e", "indicator--bacef48d-7dee-45db-9689-f5de481261bc", "indicator--5b7f9a0f-ab3d-45e1-b6cb-b579cefa2bdb", "indicator--cc0613bb-e172-48e0-af39-bec0e3fe4768", "indicator--75dbbfab-c230-4e61-baa1-c84b87b9bde9", "indicator--3be9fa86-5137-46f9-8730-6db595ba5259", "indicator--316a05ac-44b9-4d0d-9afc-3459d173ba97", "indicator--7cab72ae-5bd6-41c3-92fc-00b745dcced2", "indicator--bebe4d3f-8de3-4ad8-9f94-914d20b23971", "indicator--672182ba-0def-4fcb-beda-0b185456b5d0", "indicator--1bafa276-58b5-41ba-ac3c-3a74764036c7", "indicator--bb4e6d97-0ffc-40bc-a969-206cb877c179", "indicator--8c1a7067-3319-4354-8a90-b2b4baab97a5", "indicator--c5b4edac-2548-4484-aad5-7f48f4167ed3", "indicator--b9d0755f-3c08-4ccc-9403-616b9176818c", "indicator--0edaee7b-b775-41f9-8f08-2edf5fdbf072", "indicator--fd530d40-86ff-40b2-b598-e119babfc9a4", "indicator--cd1ead58-fec9-46ca-9164-be5d325a865f", "indicator--87ed6a71-0bb1-4851-bf79-a09cf0154bdf", "indicator--0d9e267a-2f3a-4e5d-84eb-9c3808d43b95", "indicator--5791603b-deff-4705-93d5-2668d8243e06", "indicator--275b2a39-8454-4df9-8d59-060d3956e6d3", "indicator--0602fa84-345b-44b1-83b4-7199372da20f", "indicator--6b32778f-c385-4454-b01c-2061071e63f4", "indicator--b4cb8aec-be89-4cca-9af4-2024b2584e53", "indicator--3135d518-c773-44ff-8f1d-a5f4bccd9c93", "indicator--b0e02ac1-6ea7-4628-8c7d-4ce6b783ad2f", "indicator--d4bcdabe-fb18-4bbd-a785-a52ff672fb29", "indicator--b8af1754-8746-44ef-8747-c652e357ccf9", "indicator--cc841294-7c24-4f7f-ac96-2a79e6f61814", "indicator--e5eaae57-0199-49c1-8c00-0a70befdab95", "indicator--67667cc6-c55c-4af9-9950-90a6ffd2fe67", "indicator--da35cfbb-6ee3-433d-a8b5-0d2bab1fdeb7", "indicator--b97e8fc2-142c-4323-8af8-cafc4573da9b", "indicator--d64c207c-eeab-45df-b57a-f970fcb0f82e", "indicator--f0026e03-6ccc-4b74-ad0f-d235daa334eb", "indicator--018a62b0-2f45-40ce-a316-ff62328d7fa7", "indicator--6fd0f538-3cd9-470b-bcc0-a3f4a59e5f90", "indicator--75464c17-da67-461b-a99b-d68315cb7efe", "indicator--71c6c1ab-8f25-4099-a44d-0404a08d0d35", "indicator--8c9fb84a-7df8-4d0a-8bb4-846d0a85803a", "indicator--92700430-753d-4a55-916c-d85d784dbd95", "indicator--824a6954-c0ec-48aa-a47b-68edb2b1628c", "indicator--9efeccbe-3c6e-4f3c-916e-1bb0741e254b", "relationship--dfb7a0bd-1f41-42a8-954f-716935eb8a5a", "indicator--d4b34a5b-b5ad-41a1-b8d6-df2072ce3a22", "indicator--57414713-1bd4-47c9-9cde-2442a2af0ced", "indicator--8c518d2c-9606-40da-80de-fca1de137265", "indicator--80c50939-b955-4555-84d6-c0f4f974d42a", "indicator--9993de4c-3f7e-4d20-aa26-2b361282eed8", "indicator--ae5033e0-6a37-4a41-94dd-668a7b9860fa", "indicator--62ab3676-1f32-43a4-bd8b-af6cf95091e2", "indicator--c616cacf-e2e7-4546-8d1c-c49eade7d362", "indicator--17c3a6ae-de4e-4c2d-848d-08af9a72b4ed", "indicator--d0b15fdb-0664-45f9-9935-e95674e31b86", "indicator--f913a1f0-919d-4566-ade8-1d0c109a59b1", "indicator--ec0c45b7-d35b-4e0e-a733-b870af22477c", "indicator--dba91ac6-7254-4a94-9e1d-db93ea03c546", "indicator--30258be1-413e-49d4-8051-3adf42fe8895", "indicator--e5a411f3-c00e-4458-a116-f70f8b811a70", "indicator--8e4f3fdc-2fae-4423-9f5d-c78956958e76", "indicator--5aaa1eea-d22f-44a5-b2dc-f0ff67142021", "indicator--36ab2aff-6241-4d92-a728-d0521f945f45", "indicator--f3cf4ebf-0375-45b8-b329-3eebd2eafa14", "indicator--3b993614-bf0f-4b3b-a3a5-d2b46a843954", "indicator--8002a538-f537-480c-a5c1-d2d07c4b6739", "indicator--f5977bef-50d1-40f0-8249-f2fdc04a7db9", "indicator--7c252437-bdd9-4270-bb59-d5b9cb6b3731", "indicator--239fcb30-4388-4937-bd67-9de7566fd96e", "indicator--525bef1a-1fd7-4f1b-8d44-39686d745c25", "indicator--d3f90b7c-7d65-48a0-9d61-7524cc3e844f", "indicator--8bd94530-7166-4bc7-a217-f97f1b486e0b", "indicator--9f69b89b-0667-4aee-8fc6-2a2113ea4b4d", "indicator--e1208cee-830c-4cad-8a23-3504f4bb597b", "indicator--1b466789-9534-4912-a0ef-d00334f5e6f5", "indicator--42216151-4115-4e2b-9154-731c2998b4e5", "indicator--6999449c-9378-4c50-a180-9a7bbe7c460f", "indicator--72df54b3-efa4-4765-81e5-95b055878eab", "indicator--7ce52094-c269-4fc0-b928-1378eca5ced3", "indicator--983a62b9-7601-436d-b9b3-51c2c8d90f96", "indicator--07da5971-c450-4caf-931c-d5d336904e3d", "indicator--e33497f8-03a3-4651-b481-3f0d7ce92e5a", "indicator--f601597b-ce1e-49f8-98ff-361f25bbb454", "indicator--87a08e5c-f2c3-4b3d-907f-c78c3df87305", "indicator--c401be5f-b6c7-4df0-82f5-b2475172c5e2", "indicator--541613f9-87da-4989-af3a-37c592154e2a", "indicator--8ed299a1-ae41-434a-b5dc-e7bad01bb395", "indicator--8debc819-7d3f-48f9-bcd7-93067dcd3af3", "indicator--672aafa4-a419-4771-b83a-eb9afba5bb25", "indicator--a943d3dc-8701-40c3-9edd-32f1ba732473", "indicator--87088714-2d38-4f07-be4a-e484312b65eb", "indicator--2bbb3bb1-d858-4688-8275-a95a9454826b", "indicator--796008b7-17d0-4ea0-9f69-f0f5b02eaf9a", "indicator--754baadd-2d20-4e98-aeca-c8245f4cf660", "indicator--94bbbba9-8cb0-4843-b47d-6a088ff27094", "indicator--cc1f6fa7-9a06-47f8-85c4-e53d58ac762c", "indicator--38bfdf3c-13b5-4225-badb-f73c589123f5", "indicator--91a5b888-a20a-4bb0-b372-37848bcd6ab1", "indicator--cd54b1df-2fae-4203-82cb-e8031641f110", "indicator--a70ec9d6-2e23-4278-b4a4-7e2dc73f3a62", "indicator--1c8ce3de-e0a8-47b1-8c80-fd9b7d765099", "indicator--0b2330df-ebd5-46d9-8dc5-0ebb8c3254e1", "indicator--54e97c99-b8c6-4638-bb37-cafaab7df193", "indicator--c818378a-692c-468a-b7d3-b58a7a75c2d4", "indicator--590483e7-12f5-4585-a750-95c0253f4854", "indicator--8264fe5f-98e1-45e2-b8f5-d066a010f071", "indicator--d0949b59-86e4-44ca-8ee0-e1b34d06c91d", "indicator--42c26e3d-78dc-4882-9f22-11a08800ea8d", "indicator--ab0cde47-47a8-4247-834d-d25566f61e69", "indicator--19cc9d0d-1266-46dc-a479-570441ed2b4e", "indicator--f521edb0-bc29-4d14-96bd-4297b80177b4", "indicator--fb6aa49d-94bd-4a05-bdd9-a99312217556", "indicator--c20bbb40-921c-4b4f-9d66-7b282b94af64", "indicator--6842296d-4b44-45da-98de-77527f9efa3c", "indicator--42e3009d-e4a5-4660-8553-c5a9a055a011", "indicator--3df7d132-a548-48b2-a188-3eec68a4c725", "indicator--2ba82e93-a8a9-4aa9-99ad-e2d3561a7051", "indicator--2eff6163-5cac-41bf-8170-183b8b1d7473", "indicator--69d49fbe-0a01-4217-af0b-3a976e74b083", "indicator--dea59a6e-ce77-4881-a158-8b2bd18575a3", "indicator--4102e357-b6c8-40fb-9dbf-695741cdf0e1", "indicator--554b22fc-db24-4b7a-aa68-b3421788e279", "indicator--ddc3af7d-e451-4f42-a89f-56924a016ead", "indicator--c6350f8b-fb78-4126-94b7-74b2f091f3ab", "indicator--eb35bf47-97ec-4295-921f-ac2de33d5263", "indicator--e6f12991-6bf8-480b-b016-1c4c3d9b6735", "indicator--5f09ddcd-8e07-40e9-ae42-19fea9287a84", "indicator--f3295fc4-b4de-40a5-8a39-5ebc18649f73", "indicator--6e0cbe4f-3a0a-4f53-8eab-78f1acbbaaca", "indicator--fb0543d7-dac7-4018-b626-907aa0d815fa", "indicator--1839c78f-4494-4db6-89f7-07c4a497b4a5", "indicator--3c3812dc-aaae-4c4f-a7ef-c036a332bae7", "indicator--e8cac18f-8ba6-4a6c-8e67-562e7fb8774e", "indicator--ecd73a6e-9ea0-40d0-9d1f-9933fa03d358", "indicator--d97066d8-ea1a-4e88-8a26-a0fa2f17c0f0", "indicator--cbc8f01a-7c9f-42c0-bd79-b0246d95c005", "indicator--e66526e8-a222-44d1-a611-18747744dad4", "indicator--ae0c68ca-f4a0-4cce-9df8-77b2b78df081", "indicator--ac1d5e57-d270-460a-a4c7-46100bcc38b5", "indicator--1c2241d2-13c3-40ec-bc58-5aecf3ae474e", "indicator--1076624a-6d13-4d6d-abaf-dc177fedef1d", "indicator--f2be3226-7100-48fe-9744-172fb1b16967", "indicator--b77430f7-eeca-4697-ab63-779b88011cdf", "indicator--d674c669-f51c-42fd-ba2e-5c3faf36d17f", "indicator--ea8e81f7-e872-4976-90bd-a01ec60204b1", "indicator--022837ae-8167-4ffe-809e-e8fe76b19d32", "indicator--3432c5bd-0db7-499e-8356-9de1d6b5305b", "indicator--3624358e-1e5d-465b-9304-a3a56b1e398b", "indicator--d4dc51be-c7ca-42c8-8298-e03fa06b9ab7", "indicator--f594981f-60a8-4dd1-b188-d94cc878bab0", "indicator--7241bb68-1782-4504-aaf9-b8eabb681a26", "indicator--22ba58f0-7569-4a7b-96de-d6fe5b99a248", "indicator--c3288b32-0279-4a57-9dca-6cdda180c6c1", "indicator--2f841780-b483-4a78-8c06-f525f71d12f5", "indicator--681e997d-502e-4330-92c3-a8192ea91bb5", "indicator--21e30c7b-a329-4c97-b702-e04744459975", "indicator--78d3e53b-2654-464a-80e2-91b098c29788", "indicator--eb2cb903-74d5-4c52-86bd-3f763745931b", "indicator--09fe448c-b42e-483d-aac8-7dae1b430a17", "indicator--ed394c0b-33b2-4d13-82b2-676c393823e6", "indicator--7615bcf9-b080-4500-b2c5-3fb6c0514fb4", "indicator--0b42210d-aa6d-458c-9ee3-cfc404acb780", "indicator--1fc7b584-3a9f-4aa6-8cdb-adbff27b0fd0", "indicator--4c2158ab-154b-4f00-af40-baea05fd9132", "indicator--f41bf254-9fcf-41a2-aa84-24cc3cff1205", "indicator--72115934-4ebc-41d5-bd16-b0bb0c7969ba", "indicator--f79dd9aa-d977-4ad8-8aea-7a24d91d5794", "indicator--d66a4de9-f9e8-4a97-b54b-a5dfbcd61fd2", "indicator--ff980758-e883-47a0-a6e8-515bc1f0c866", "indicator--d5f1a713-a48e-4c7c-b80c-de3aa73bcfe8", "indicator--205db2a3-9dc9-4a5d-833c-b42fe67c0226", "indicator--189ad14e-4778-4d69-9f7b-3482d7b73906", "indicator--85abaf5c-eb29-48d9-8c12-6cf1e51457fb", "indicator--0fce9ae9-b29d-458b-ab9d-b5f1a0e6d568", "indicator--abb164fc-34d4-41c9-81e8-1dde6703fe7d", "indicator--bdb9b4c3-3789-44ec-b0cd-0592dd3bbd52", "indicator--3373faaa-86b1-4dc5-ba6d-08402307c6ea", "indicator--3f95aba1-ff3d-42f2-ae27-7c7009d36d3b", "indicator--d7c88eeb-e7c5-4ca3-8c23-f0ddcf33c812", "indicator--1982a2a6-e961-4df2-ad08-6c0c68b7d5d4", "indicator--254b6df8-b08b-4dfb-8fca-cf883afab1d8", "indicator--84051fb5-2f14-4846-bc71-12a515b7ade3", "indicator--ed01cad6-1aab-4d8d-a69a-51f1b0472ab2", "indicator--2b534d9c-cd13-4813-90d5-0a377a8d740f", "indicator--f7267186-3dde-4c55-99b4-942859c495c4", "indicator--a8661379-eebd-4906-a94b-7932cef25639", "indicator--3149b6a3-bbdc-4897-9386-08c707136ca8", "indicator--f38504fa-1a48-4aec-80dc-21cad88a24b5", "indicator--9c3d4f38-a99e-4e2e-aa2c-b936d5232e75", "indicator--1c4bc376-4a0e-42ba-ae50-40b604ddb254", "indicator--c9f71cfb-a317-4fa5-b035-ca4fbd8a9582", "indicator--a878c5d3-8834-46db-a799-41dceefb3d04", "indicator--efe3ec43-3dac-4abc-a5cb-7c53dea9313b", "indicator--324acf69-5fc9-49e1-9229-2636a029113f", "indicator--ed52a6b1-b8cb-4f10-a274-fdcad9dc2067", "indicator--2a5513f4-0ade-4ebc-9cf0-418bbd4b52a4", "indicator--9551a54f-4ea4-4a6d-b2a2-9cbf92b03753", "indicator--d739e62e-623e-4507-abe5-5a5a8b3800cb", "indicator--f08a3b34-aaba-4114-9e95-e94ae5cf3be8", "indicator--9f9f586a-d78a-406e-9c49-8fe0434844ea", "indicator--3fcbb345-2683-44b8-aab4-8ea6fe6d1d5c", "indicator--68e4b591-b399-40b7-9289-7319b2eae22a", "indicator--aea157a7-972e-4b73-80e7-6744395623bc", "indicator--32b20927-291a-4778-b95b-0f331f8cc68f", "indicator--e07accc1-cf36-4482-a082-dc5e6619b00e", "indicator--9d98d0c9-d7ce-4738-981a-5a3df8bce15f", "indicator--9431273e-dfd2-4540-89ee-04e9272c1b9f", "indicator--48c8b3b4-668d-4565-810f-3d14ae7bcd0b", "indicator--a146d82d-08c7-453b-9cc3-e5fe83a65ba2", "indicator--47e08287-fc5b-46fb-93dc-3e79590d1d59", "indicator--b666484b-e964-4a3d-8636-65535508556f", "indicator--3757d4ed-2734-4334-b0d9-f373da60b7e4", "indicator--b0120599-688f-41b0-a526-d1448d9d87b4", "indicator--68a7fa4a-91cf-4db7-9aa5-1f45f63e9dd6", "indicator--030688b7-f69a-420d-97d3-a24b3cba6c6b", "indicator--455abdea-addf-4705-8162-491e8d4146f0", "indicator--bfbc623b-05a1-445e-8fdf-322bfb14b1a4", "indicator--f0559259-e73e-4c7c-ba98-4010500e3052", "indicator--a3c2ddb5-a87a-458d-8a17-a74a29343802", "indicator--80952aea-14fb-419f-b0bf-0f4486e8d8e2", "indicator--e88429a6-3b0f-4c58-bc39-5716d599a356", "indicator--5c1b80c1-40f7-4e71-ad2a-551a5add953e", "indicator--6f5c4d59-3ecf-41ca-8580-98aefa61e76b", "indicator--8eba7058-fbf4-4d09-96b2-989db3e58b0c", "indicator--2a038ab9-e567-4c43-8cf5-8018594c1fc7", "indicator--6d753c2e-f476-4df2-8316-b266069d4f63", "indicator--9ecbec1f-f7f1-44af-876e-638aac3b9fbb", "indicator--e4a731cd-5789-4b9a-8aad-713eb571ef16", "indicator--70360dac-750a-4991-80fc-1077f359ef3f", "indicator--758ac1a3-c0d2-42ac-afb0-8c377346a450", "indicator--d93bb361-b4a4-4a74-80af-5b3fc0033983", "indicator--27f48625-0ee7-47b1-9766-bf2b026fb69e", "indicator--1f73dceb-f87c-4e51-a0a1-b3591596c720", "indicator--39286495-3d28-4b7a-abe5-037dbc75ef84", "indicator--e7567796-27e4-44e8-ac00-8272c6dae934", "indicator--ca0a189f-567f-473a-a918-553878d49b13", "indicator--fe7a2847-f940-446c-a9ea-7ca40e5c3de0", "indicator--8a2f7a9e-5272-418b-9c7d-d5b03b71b4d6", "indicator--f5a7345f-9d0c-4a07-8154-c3d121d49336", "indicator--10c87911-5c58-4a78-a6c4-f6c0ab0f0138", "indicator--55fec52e-8f5e-4c25-9268-6c89493209fb", "indicator--cc81ddb9-09ec-4a7f-bcc5-d12dd8fb3097", "indicator--bcafb6f7-340e-4894-a052-e15847a96877", "indicator--3b898534-2e8c-4d39-899e-916fcd61e9b7", "indicator--e53a344d-45c8-4611-aca8-9121d5e20399", "indicator--11ce32ee-aeaa-4745-8a5d-5ca825139ace", "indicator--a2f1f4dd-887d-41eb-b314-507f954aba78", "indicator--7af2ed73-4101-4697-a6aa-5913e50182f8", "indicator--44bf49d5-5205-43b4-b7bc-b4df765ebab7", "indicator--15e0ff45-bc92-44fa-ae24-1537c32cf2e7", "indicator--e96b8292-a393-4d48-9286-cb4f7974d8fe", "indicator--133ee5c1-8963-4c65-b9da-fb6644243292", "indicator--1728935c-47c9-4f2a-80f9-1cd74c30553f", "indicator--1a01dc6c-6b2f-45da-8d8e-b75377265f37", "indicator--55838c0a-a471-42e8-b083-d933038b9f1f", "indicator--cb08fe09-4bf6-40db-a72f-e6344752fe39", "indicator--30a45070-c9ef-40cb-96b1-906bb142ed41", "indicator--5e0a89a3-118a-4b77-aab1-a90bf5e2a829", "indicator--f142241b-da30-4467-b7ea-54e6b23fd8fe", "indicator--626ed23f-1c0b-431a-8f0b-b270110d5904", "indicator--a6025ba8-3050-4343-86a7-bc9b8735b167", "indicator--8cdbc129-3554-43bb-a7ae-9c973a2b0fee", "indicator--1bc55c8a-7633-41be-a564-a8affcab354c", "indicator--427519af-b3b0-4697-a034-7ee3536a9563", "indicator--5d101c22-1bb3-45e8-ad2e-b41cb0bda5de", "indicator--d25a812d-5a8c-455b-a338-b8ccd3649295", "indicator--22e4d6be-6666-4fa7-94e2-e70346006b47", "indicator--834a3f9b-cbf3-48e9-a186-b76381cc04c3", "indicator--0f314531-08a6-48d8-8cc8-85dfd152772c", "indicator--564ad651-1dfb-4fb5-a44a-9aa801065ab0", "indicator--58751697-dcbc-4990-832d-8064b9ce28cc", "indicator--25b4b8e1-c2f0-478a-be82-b2e9de702e16", "indicator--8dfaed1b-f1f0-4bae-aaa8-4f9f03dc25eb", "indicator--d67d2c63-fd4c-4c13-9e45-b45478cb8647", "indicator--20411aaa-a624-4c20-ba1e-3c84d9384f82", "indicator--16b0fe92-237f-4ba7-8e03-0300f2e153cd", "indicator--bddcf2cd-f53d-44fe-9475-13a91572597a", "indicator--b251ed12-2e68-44cb-9cd1-d6757744ff79", "indicator--fc0a826b-6e48-4828-b01c-ca463658f8a2", "indicator--489114e3-1967-4716-9aa1-ea50561b9d33", "indicator--d216770a-a4b5-4a52-a8fb-723cc8623b56", "indicator--ccb4dbe4-9e69-4095-99ee-82011a0f3a0e", "indicator--8afbb396-6680-4e10-8b2d-016a594d9317", "indicator--1d2c8eb0-556e-4dcf-b037-063d2324e853", "indicator--b74754f4-dcdb-4934-a3c0-615847e33003", "indicator--f880835b-c025-4d69-8e19-4e03dcf8e62a", "indicator--032b4e7f-6607-408b-bc71-ea386a720841", "indicator--2e78c447-ac27-4454-a54d-1ce01b5e8f76", "indicator--10378ba2-8acf-4955-9f29-3b3044c46df6", "indicator--e9d669f3-9254-4daf-9343-8659ad6d12a1", "indicator--b7ed7fdf-1d7c-4cac-bb07-290d4433732d", "indicator--c78a8713-5233-449d-ad7a-a2896fe5bf32", "indicator--b27616a3-af0f-4370-a8c5-1e29e1986105", "indicator--87552243-d089-4bd2-ad67-a3ab50af7cda", "indicator--e1ee15c4-cde7-40e6-9627-5782b1c91972", "indicator--6b363405-3302-4f71-921a-a27b2cbbdb05", "indicator--0bbc2fc8-1607-4eb4-889d-6962e4ec6756", "indicator--ee13ba41-2919-464b-a5a4-11aea97ca7d7", "indicator--f3c14e8b-c100-4a78-ae07-ee37b67b4331", "indicator--5616794f-0559-474e-ad46-9f5e63e60295", "indicator--77f20a77-b5a3-4df7-af3b-3170d4224942", "indicator--03026854-6490-427d-8285-e9add5cec9dd", "indicator--f94c4cdb-fbac-45fe-80b7-76d00eebe0f7", "indicator--bc7f710f-9ec0-49d5-98a7-d2ced339ec08", "indicator--dfa0f7d5-8380-4a1a-a9db-611fdc60788a", "indicator--2d1f3393-c946-4fc6-a8ba-d4af0d244f58", "indicator--cbbb1c80-12b2-455e-9f2f-a7fa34e6110d", "indicator--342749c8-9382-43c2-9468-56b8684fb8bf", "indicator--66b2fd9b-80d3-4d60-9f12-1d7a120bebf0", "indicator--97007689-5c40-447d-9530-75f45f341431", "indicator--d6d20c07-480f-4d6a-ae50-a52c4d4d3a75", "indicator--c1638c56-9488-41b4-83f7-9c370c1aeb34", "indicator--221d5259-4b0d-413e-a0a9-35f7e19d85be", "indicator--c8c544ff-9011-4ba8-b010-838c3c26396c", "indicator--742b7e8d-8e21-440f-b22c-59571124ca06", "indicator--d6b370ee-0406-4450-b3f2-40fe1b06ef05", "indicator--74408aea-37cc-4f0f-986f-257779a10ea4", "indicator--d2cae3ea-81ae-4836-a0b2-9b1358f7ccf5", "indicator--bacd56a9-df34-46f9-a0c0-5dda24cf74ef", "indicator--5a690a50-86cb-4e1c-93f0-2f35bb291d0f", "indicator--827df13f-6f98-4199-af41-c15c7e03d196", "indicator--17b11b69-2062-4ebd-a361-f3ec05550fc2", "indicator--c870ef0b-542d-4dc1-b015-ca927c3a379c", "indicator--8b0a22da-eefb-413c-b9ac-23353a4ec15d", "indicator--78a6635f-2084-438a-b909-6495b47433d8", "indicator--45991d55-2069-498b-bfe8-6d321cef7691", "indicator--381c9cf4-6ad2-404e-87e3-f728d24832c4", "indicator--9b8f5407-e31f-4415-830e-f61a9158ab55", "indicator--c6ab6c79-23a8-4af1-a49d-1d222524f56b", "indicator--3b99130b-c664-42fa-bda3-04a4da960e48", "indicator--db973404-171e-473f-9542-7ff7040de28b", "indicator--ee35f8f1-97ce-44ab-8c46-dd59a11987ce", "indicator--33b3449a-667a-4598-a6f3-d8ac6661f271", "indicator--07929e2e-4ad2-46f0-91de-9ac6ae41be66", "indicator--39dfbfb6-b816-40e2-a72d-637ac8a06ca6", "indicator--b1cbd55a-ad5a-4b15-93a7-1c9a0ba74422", "indicator--3b7e87d9-9c97-4560-bc06-78f5eb9af203", "indicator--f0de1d33-2052-47e1-8443-e613cb191fc1", "indicator--51991e77-b74f-4c86-9e15-42c8cea14b1d", "indicator--795ad1f4-a18e-4add-bed5-09b67c440a8c", "indicator--06a548df-b895-4801-8a9d-4da57346fcc6", "indicator--f358dcf1-c3b8-4c5c-b7fc-fc0d09e00831", "indicator--b220d4d4-02dd-4f25-8986-a676ad591021", "indicator--e857a9d2-8ec5-4686-b808-2728067b8067", "indicator--88d52929-1627-45f9-9b05-1e4ccdca340d", "indicator--9c197d81-048e-4899-a877-2fa7a517f2bf", "indicator--ce460f4f-f621-4dea-ad5a-a3d653ef2d74", "indicator--55b8a452-1017-4de9-a7b6-148ded1e715d", "indicator--7202e57a-8765-4d13-ad0a-30cfedc1dcbf", "indicator--e0ca4a4b-0954-47b9-a700-79b27fef4c9d", "indicator--1f0e5358-4c73-4d6c-a3bb-25573124cec8", "indicator--db88413c-ac26-4981-ac82-340a24aeae7c", "indicator--70425bb5-1877-4231-b342-0ed8d385987f", "indicator--11f4ac6a-ac04-4af4-b2eb-7cb36ba8a4e2", "indicator--704d3c8d-ec78-4aed-8ad2-6af4aaabc072", "indicator--b3dad900-4063-4395-9c56-bd631499b007", "indicator--e16520b0-66ba-4413-a373-af31074d7a05", "indicator--56e054e2-ad24-4f0b-b0e2-5c5f1e25414e", "indicator--02be40c7-56c0-46f7-a8e2-14c57ce271c7", "indicator--281d7816-b6b7-4186-ba53-2d5bcc74a4c1", "indicator--d012e707-81db-4c7c-8d80-29f74b73912d", "indicator--438257db-8991-4568-b338-27978b25e1e2", "indicator--e5969246-8b1e-460d-95e8-8836009e9403", "indicator--20b5c498-547b-4b32-8e20-aa6a2b9a661f", "indicator--c0305b60-e2df-4626-9e06-b27f370863cf", "indicator--28b1b429-2ad6-4bdc-9631-618a37f79721", "indicator--4051175a-a980-491a-9130-afdf4bdc1bd8", "indicator--5fe042c2-0944-4efd-92a0-2f9ca48b8d14", "indicator--85b9a972-6e04-4272-a1a2-5ea67f661d47", "indicator--4d9832c6-5e40-4eef-baa9-3024c64445b0", "indicator--70f884d8-7199-4e90-8e43-673e8d4cb067", "indicator--e2e5a79a-9318-4f50-a936-5c1cd6dd3d22", "indicator--540c5c61-07cc-4529-bf19-bf9e30fc5615", "indicator--69e6d25e-babe-4c7d-83b1-7364bbee5f7f", "indicator--1562b0c8-6c8a-4ba5-9ac7-6f74ed1429e1", "indicator--c3ac3cdd-9c74-4579-9288-76811af04d52", "indicator--7403430c-7bb6-43a1-a14f-28df1e8fb305", "indicator--cfa7073d-fae0-44a5-a639-aefecc7577dd", "indicator--5ab12922-8d27-4cd7-9d23-8ea6a63eaaaa", "indicator--28139a38-2062-4666-8f89-835f161b041a", "indicator--69eea157-985b-46e1-8e66-e285043886d7", "indicator--05473798-f93a-48b6-989a-f671fd089555", "indicator--892ea142-9c22-4d24-aa21-38e3021af154", "indicator--383b79e2-154a-48be-a738-b7ef5befa047", "indicator--402c46d1-303c-4341-b7d9-cf63d9ac9f95", "indicator--80acc271-41fd-43dc-9cda-a34a88196a55", "indicator--a90953a2-4172-49d9-9757-255ad56ad1b4", "indicator--ba069af8-a57c-429e-b62f-7ec8f2c9ecc9", "indicator--956bc7ad-a1c4-4596-8194-d0acf9097faa", "indicator--1856a8d6-b9af-48e0-9c63-fd7c98c89c9a", "indicator--3052abb2-e2e8-4126-81f1-b2e1db6ff94f", "indicator--894fc737-43f5-4e58-b281-088fa610a622", "indicator--b1a31da4-216d-460b-a97a-08e6d3b4f77a", "indicator--e3b9048f-bf8e-4daa-8c83-e1b9b4ecd0bf", "indicator--b146afc9-a0ef-4728-b48b-8bdd0c88ec65", "indicator--d17b27af-0b72-4264-b0be-995f230ab25d", "indicator--02e3591d-99a0-446e-bd22-f9f4f7635371", "indicator--efaef0cc-f2c6-475d-84d7-00e6048ee631", "indicator--74c0f5d4-b5b8-4652-9f8f-c8ab072a9143", "indicator--e3aa02f8-43c0-45ee-a8f9-f7794b2fd7f6", "indicator--3daba74a-7c1c-4110-bd78-62f778b1a364", "indicator--1b7be389-539a-40bd-8ba1-bda76562292a", "indicator--f7e34b56-f55c-419d-8437-6aad93b735fe", "indicator--9258288f-6e44-4a95-a9b7-170848d868c7", "indicator--93bf81d3-cc10-42c5-8ca2-38acfcac75b1", "indicator--94f4cc34-6160-41e9-9025-c0c961e5e834", "indicator--1f0a87a8-e369-42f6-b6ab-dc39be55c839", "indicator--aa363664-9b86-4df3-ac94-ca352543b6bc", "indicator--5d05fabc-b4eb-4942-bbd8-f13379fd8912", "indicator--00345625-69ed-4cf8-b206-920517b1b405", "indicator--98a830d2-a807-4abf-9055-888c29c92486", "indicator--0fa1fe63-2a80-4cbb-aed0-52a24190f973", "indicator--f568f8d8-ab2f-4270-a546-60f3695c3d57", "indicator--551269ef-b416-46f0-b863-92a31e3f6f19", "indicator--f24e107b-f641-4b54-8e45-d8ed0e821d54", "indicator--3b9c0dbc-17dc-48ce-9ecf-a93737e2b010", "indicator--762f1fc6-0738-4436-95f4-f4219660db13", "indicator--6b38380b-e683-4acc-ae5c-bb85dd29ed77", "indicator--183e3323-3929-4d6a-9b9d-aa634a853ce6", "indicator--28e34560-40b4-4e5a-a78a-bf024aa77271", "indicator--a5ffaccf-5b61-4979-8261-d1ddfbb081a2", "indicator--619a47fb-7b8c-413a-8dd9-f445d090be61", "indicator--d8a99570-ebd6-4d45-840e-7ae1f78e47f3", "indicator--1137e604-1327-4498-b72e-d68b65bcf238", "indicator--1227ba86-e6db-4a53-8eaa-780b4cf0eff3", "indicator--e9f22462-1cd9-4cd0-95e2-b09fcc5173fe", "indicator--0d66ac1d-aa48-4884-9022-060b6fb39edc", "indicator--34594492-fcd1-433a-9bf6-ef5df8dd7991", "indicator--3c0a2dfd-6cf9-4183-af19-9f92500bb45b", "indicator--6e95459d-7559-4c7a-a987-172a119c193e", "indicator--9409cc25-4328-44fe-a0ed-d3057a6419e7", "indicator--4785beae-4db7-4c6e-88c6-46ac1d664121", "indicator--4146b0e2-b43c-4930-af29-52856fcf9006", "indicator--bcb1209f-fcee-40d6-b857-371cfcdfd7de", "indicator--2111258d-5d33-4005-beaf-c0c409439c74", "indicator--289405b0-e47f-4420-a97a-e93059ac9b4e", "indicator--0f0c3fcd-d077-4821-9756-964f166e99ce", "indicator--c9083f9d-d4cc-4f4a-834c-9bcc610235d0", "indicator--6c888b3c-9c5d-4d3b-a4a4-0aaa844169f4", "indicator--a8bec432-87c6-4de6-aa29-206362205a1a", "indicator--2e1a4c90-f2d4-4809-b838-4aa95c23376c", "indicator--f6d4d764-298e-4da4-8a8f-f6c4be989daa", "indicator--71977040-84f9-4dff-9f75-6a8151f14d24", "indicator--4802a66b-df47-4202-9224-0935c5f4799f", "indicator--a29ff5a3-3dde-4ed4-b39e-8dea559bcdb1", "indicator--c96c16ac-81cd-4e9a-9a08-c5048665f54e", "indicator--81d02b8c-87d1-462d-af64-869e202d4f7d", "indicator--5a2d3b6e-80c4-4665-92b2-b627e395bd4c", "indicator--95b7c3b2-6d0b-411b-8c70-923f0b0429ed", "indicator--6f34a6ed-ff26-4586-ba3f-65296b8bfe6b", "indicator--48176c24-ce90-4603-9207-8f214eb6b913", "indicator--d17dab10-7f21-41c4-8a0a-b49666ff9dd8", "indicator--1d2c0a3e-f0cc-4323-ba2b-bd9b1602076e", "indicator--bcd9b46d-7741-475a-beb9-2cfd12ba2e7d", "indicator--ab94728e-068d-401d-8ddf-98077e50d7e9", "indicator--adf86590-ee39-4620-80c6-b10da85881ac", "indicator--e959885a-c2a4-43e6-9f05-c44baede4ba2", "indicator--ab90a8c1-fe42-4cde-9ba9-ca27ca53cb59", "indicator--925c1dac-9549-4285-af7d-1ca4d960b4e9", "indicator--a1b6b22b-911d-4e51-bb0b-77601ccba919", "indicator--9c4f7298-28b2-49bc-a4f2-db314560dd83", "indicator--31fe6212-9449-4c5d-a98c-45e54a4000e4", "indicator--d199306f-dd26-4eaf-ad5d-fc59d480acbe", "indicator--bd67bf77-2a83-466a-8679-f0e1a6712121", "indicator--b580f1d1-eb8c-4c0a-bb80-9a32c0d809f6", "indicator--cd129672-011a-4b74-93aa-120beb2c8d68", "indicator--692fc93d-43ab-44ce-9a0e-1ccba10eb827", "indicator--52326535-cf72-4b75-810e-8db09ba51abd", "indicator--f08d76d0-5364-4709-b1b3-0b5cdeb87da4", "indicator--45070300-c0a4-4500-9dc7-4ef7b6899382", "indicator--8da30bf0-e593-4e60-be6e-6b2a3dcd3583", "indicator--e69a39dd-7788-4483-b17f-0b70174c8832", "indicator--73140334-8153-451c-a0f8-8a8c9b9bab58", "indicator--1e0eb72a-4078-4dbb-9a05-7ec46b1e75c8", "indicator--391ca9c8-9df4-4581-bf58-0418dbafc092", "indicator--576589d7-59ba-4bb7-af62-0fedea10eead", "indicator--2b26fd3f-3447-465e-bff7-1aa101944718", "indicator--371ccf5f-16a9-443a-bfcb-c1adf6d2b8b7", "indicator--552937b5-b334-486b-842a-cf03393ade1f", "indicator--c582c3a4-7428-40eb-a854-c31502301382", "indicator--60c19246-094d-4186-976c-e92d9cb672ca", "indicator--184285f6-2462-4a4c-a4e7-b4874febdecd", "indicator--3be93231-209d-4a77-8cea-7d6ad683cb2d", "indicator--81b9bfdb-8afa-4674-98fe-81c047b5f4d7", "indicator--5b6b0a3e-ca56-45cc-bf44-1da4c487194c", "indicator--49e4a77b-a2ee-48f5-aaac-843e9e91c7a0", "indicator--069d68e0-5e97-4ae1-97a4-785ab6c07e9a", "indicator--d181f463-3937-4d5b-885e-f8efdd4995f3", "indicator--265ea406-0be0-4188-bba5-f861c97d9376", "indicator--18e55ae6-b1c8-4cdb-9096-9d8360ddfcb1", "indicator--471d67f7-dc6d-4557-b1f9-497ea5e0ce2a", "indicator--8ed45cd7-e606-4c48-a281-e6589e88aff5", "indicator--437c31a5-a758-4bb1-a97b-8a9eeb805ceb", "indicator--52f3a7ed-0321-4f3b-be2d-b486cc8a1043", "indicator--cd15b92d-d702-4657-a3e1-bac84546af08", "indicator--838b9b46-8c6f-442a-9667-062717abd07b", "indicator--cd6dccd0-68be-4995-bdbd-0e6959fc5db3", "indicator--a102b487-2025-4600-8f32-f2bcf8615111", "indicator--c5a89c1e-4764-46ff-a612-81244d599308", "indicator--ef252171-ba52-4899-a99d-e21229a8dd5c", "indicator--584e61b6-6666-4063-a85e-1528fb42c39d", "indicator--00e8b925-1237-4248-a70e-ed6ba2a2c501", "indicator--d6215002-e99f-4f8a-8cae-2fb200d036e3", "indicator--f6f2560e-4ee0-49e5-903e-4230f31f09b9", "indicator--ac4ba5d5-0ef2-4e7b-b6c7-d46b0bea6c53", "indicator--1c104080-15bd-47a7-b2bd-b3881dff01c7", "indicator--df0467cc-6c50-4260-8989-20a95d2bff80", "indicator--e4a0249c-c160-44ea-803d-059e669e89ee", "indicator--452121bf-2975-4e89-b91c-95c2f8fc1c97", "indicator--32630211-5e02-45ac-b2a5-23cc087667a0", "indicator--e394ca89-1327-4183-8b9a-8427984a8d82", "indicator--d768cf2d-ee60-4e94-ba5d-76b39f0d53d8", "indicator--2ccccc99-4536-4d46-aa0f-6aee1fb16cdb", "indicator--d402b044-aa83-4237-a43e-e22f8e2ef61a", "indicator--c0539d89-1fcc-4178-a6eb-83824731d17e", "indicator--427aee45-9af2-493a-a23e-75e168827568", "indicator--497f7d02-0b90-419b-80ef-d0fe2da0529b", "indicator--38cd04b2-abfe-4459-b7ab-58844734d251", "indicator--2254de6f-7e2d-465b-8e0f-eb70ce3114eb", "indicator--b826e01c-bcdd-44ad-8f2c-51912c19d42f", "indicator--931d8462-fdf3-464a-85bb-c2a9a6fbecc7", "indicator--f029f54d-db8c-4c9f-acdc-932487d44e54", "indicator--b160b060-1b42-4bd4-8269-7ce24598ab75", "indicator--7dc54017-08a4-4ce4-b690-a139afd5db8b", "indicator--601b8bb0-345b-44ed-9c35-8d5395f3414b", "indicator--34db0edc-b72b-4b10-b71e-de7b4ed0d739", "indicator--111ac6c6-ec7c-40f4-a410-ce6215f1613d", "indicator--f8125fda-36b1-4d2e-bd23-9b6460d415a8", "indicator--74ef818d-99a5-4d51-a3c1-a513ee7a01e8", "indicator--853c6783-a852-4f3c-84eb-8d59016e33ba", "indicator--87b92d85-ceb5-40cc-94db-3de9d5b65ffd", "indicator--1df64c8b-6997-40be-9c6c-832c6c3ab7b2", "indicator--da1219eb-8e14-453b-b3ae-f626f0533005", "indicator--d9a78c1a-4684-4065-98d1-cfb42e331e89", "indicator--28bba532-e9e0-4b90-b04c-07b97891660d", "indicator--c6feed76-eab6-498d-ae1c-2c25cdae87d8", "indicator--46976b1b-3e78-4a0d-b699-9264f0ecb03f", "indicator--4dc6e5d9-8ef3-496d-b168-0c2a09caf7e9", "indicator--4e17ee65-cdf5-4238-baa9-53f762bbba88", "indicator--3642f0d7-49ec-434c-82e8-7e4eeaa04e4c", "indicator--3c59b07d-0140-4cfa-a3ab-5b4fedbae636", "indicator--082a242e-6372-43ad-8d95-a3b7d194cc91", "indicator--6ce721c0-1ada-4439-8a8b-7111b638762d", "indicator--442d121d-b6d9-48e6-98ba-69c4bf418a06", "indicator--b7c9af8e-dca8-430b-a5c2-dc7e14bcc586", "indicator--92938efe-c892-4589-8a82-4c529227e340", "indicator--d5538726-c815-4af3-beea-8fcada5f0e34", "indicator--3108d4db-3811-40ed-a7cb-89b8423d5ed1", "indicator--569a328e-1cd8-4e85-a1dc-60282d461306", "indicator--0cd5f9ff-4e93-4023-88ff-c748cb436f37", "indicator--4212eb5a-fa9c-4aca-a2b3-16db28761385", "indicator--91b20a9d-a927-46a7-bada-2113b5c815e7", "indicator--f3a8f042-4633-49e8-b37c-fb6517eb5cab", "indicator--b303f58a-ea2b-4bbf-adf6-ca735c84e056", "indicator--63502d4a-db85-4f10-ace7-4465fb1a593a", "indicator--b77c8c46-ff65-455d-9617-bc85f6cac0bc", "indicator--8efe4e88-89e6-4e79-8082-b8ce89c394bc", "indicator--8ca4d3ab-cfeb-4412-b7c5-d2e90fc2e52a", "indicator--3e3bf827-944f-491c-b6a3-d0cf2cb8fef9", "indicator--16373cc3-39a5-4323-9623-ae157986b745", "indicator--6d5a3277-ca33-4110-bf02-44c09196631f", "indicator--52e8530c-8c48-4dcc-b742-f0290fb4baef", "indicator--1b1f7c3f-9447-40b7-ba9d-09cdea9bbda9", "indicator--53d8c0eb-cdeb-4040-8274-380b8ce74013", "indicator--a6451574-83a2-4886-89d9-6d83ef789389", "indicator--1612816a-69ad-4339-a08b-8554efe8e242", "indicator--f38b4aca-d2aa-4063-b408-ffcaf9281e12", "indicator--3f43b76f-d7bc-4abd-a45d-d359631cf9c9", "indicator--ce659f41-efb9-46b2-a950-37d841de32d4", "indicator--17db70d3-3dec-4c7f-8aaf-b3032acdb614", "indicator--500c4829-08e8-48c8-9de6-f5961dd9c8ba", "indicator--245a3f9b-6c51-4f33-a93b-afe8361a948c", "indicator--03a9fdad-0fcd-41b7-8862-972669ef0813", "indicator--1a55a57a-bafc-4d15-8046-4b7e4ba6a01c", "indicator--b42d404c-f8d4-4d5e-89b6-0d2e87a9978b", "indicator--7e1c2a88-f17e-4113-a3b0-17e8bce55c4e", "indicator--d058e3b3-b13a-4354-a22d-2924f2d802c5", "indicator--01b6b9e8-df6b-452f-91a8-dd750b8c9e85", "indicator--ff4d17e8-be78-4786-8679-2015e3e417aa", "indicator--6ad1be81-f5ec-4ddc-bc9b-1d7c92a77b07", "indicator--596f3e55-c7b4-4117-820a-f0a3c17dcff4", "indicator--5dc392d7-a452-4f76-87dd-89d1d0221344", "indicator--cb085b8e-f58d-4645-86ce-6d5b7286b4d1", "indicator--94da9b80-cfad-449c-a518-050a51111aa6", "indicator--22ab5e5f-b2bc-4e3e-a010-c1be496c9467", "indicator--530ca227-e34d-492a-a5c0-4c1cb4c6a86e", "indicator--a07b2c1e-3e30-4641-b94d-dab6a2ebdc3d", "indicator--14564db2-e049-47df-ad92-cc71b1635300", "indicator--e343d8e9-4556-4500-8d27-df17180c3ae0", "indicator--6c66155f-ffa5-41bd-a30d-b657b63ada8b", "indicator--5815880d-eee5-431c-8d07-d7acefb76975", "indicator--4b73afbf-40f6-4a50-915b-50df2d39aad2", "indicator--3b46b20c-37f8-4a43-b299-4a27f98fc4eb", "indicator--12fde477-b848-4912-a2a1-6d206a051535", "indicator--7ebcbfe8-fe44-4c07-b126-4189b9abf5ba", "indicator--4d7540ed-4587-411f-a15e-4fa834bc3df2", "indicator--11f3248b-ad26-4f3f-a052-f4df110930eb", "indicator--21caff11-263f-49f8-94f2-81f439194fa3", "indicator--c5393c3a-2b5a-424d-bdee-471046a1c89b", "indicator--cacedcb1-b5da-497c-aaae-7112275044af", "indicator--24601f6d-6479-4a4f-ac45-3e7ee2425254", "indicator--29a474c4-45b0-4a3c-b773-b0c96e97fac4", "indicator--21ef9a40-b2f2-4c28-9657-d583005e9806", "indicator--166c0ab8-445a-4fbb-868b-21b20478765f", "indicator--7929afd6-15e6-4491-b681-e4ef4557196b", "indicator--29dac5e2-873c-41f8-a083-aeac4385f3c7", "indicator--aad68db3-df0b-4470-8e9a-8cca3af43862", "indicator--7c890d16-a226-4492-8654-b64cc2f199ad", "indicator--3dd218a2-da24-40e8-9db1-62cfecb3ed99", "indicator--31ec3895-3145-4740-ada2-e9f9fec0ecfc", "indicator--54cc4d9e-ffa4-4416-8ea6-8d7b6320f43d", "indicator--6c6636f7-3c32-480e-bd6f-06f76037baf9", "indicator--b9101897-5344-466e-90e6-08f36f95005e", "indicator--a3eb2f54-2d38-4376-b050-df245077ba57", "indicator--fd1ec12a-e373-496c-bda7-b3b7c3a59fb5", "indicator--f4464e1b-3210-49af-9ccb-e360d089508e", "indicator--1b976b03-73d5-4489-a631-8094dbf32c7e", "indicator--2444a02e-bc3d-4000-817c-8ed38c000af6", "indicator--f29a2ad1-de9d-4bf2-b94e-325665bf8cc2", "indicator--bd1e24cb-3066-42ca-8f3c-84b4a38b1af1", "indicator--3feba1f6-98d1-4b40-aaee-9e39209c7526", "indicator--954061a0-2524-476b-b325-251676a80a02", "indicator--6006ee47-96a6-4ffe-8350-ce602595bac4", "indicator--4ae6cc87-8b4f-4d48-9a6f-14aef347e1f5", "indicator--8ed9be5a-1195-4001-9330-f6a1ba512cce", "indicator--0956f976-b6ef-4c25-a44b-aac76308edcd", "indicator--3eb4c117-f641-4040-8d3a-510feeb4d0ca", "indicator--abdb42b9-cbe5-40b3-9fb0-bde2bba0287b", "indicator--af171743-1d9c-4044-a6de-ff24e8d02c1c", "indicator--16241797-43f0-445a-aad4-ab0f10dee0b4", "indicator--4f651682-1358-4076-885f-18194abb90e6", "indicator--f8b59b85-0455-430c-b745-ded350b00fd0", "indicator--ae3253e1-3b3c-4237-a15d-96c9cb15a37e", "indicator--1f5fc28a-dd09-4a73-aa73-c679abb46088", "indicator--513b0f5b-b711-4834-bce0-13ac6dcfce90", "indicator--baf46adb-2451-438b-9718-4f7cf94283d4", "indicator--fffa9e97-fcba-4bec-91a3-33372adb84ac", "indicator--da6a5ee0-d76e-4f91-8d64-afecc9eea716", "indicator--c440a33c-e22e-4b04-a9a2-766746d74867", "indicator--f1a0a5cc-167c-47da-98b1-9150c13e3b31", "indicator--226369df-4fa1-4240-9150-10e485909a81", "indicator--59633f11-1a69-4b21-982e-0185cc28c224", "indicator--66c0727b-d533-49a0-ba21-bc3ee5660047", "indicator--479de9b9-aa68-4cd4-9e1e-4803f9a08ee5", "indicator--b37ba4c1-e37a-435b-8ea9-4c1ae820ed40", "indicator--a81af731-0121-4881-a1da-42d8c116b5e0", "indicator--82905ac0-5070-4ce8-a2c4-208a99613097", "indicator--79854266-7431-47bf-afdd-fcb291c94e71", "indicator--b6ad8979-44d0-42de-9856-1cb94fdd409d", "indicator--ecb9c9f8-3a5f-4e86-b8db-b57e6643e301", "indicator--721b005d-82af-40b2-a225-2bb89c03d325", "indicator--dbda5b5a-9577-4222-91d2-01934885f725", "indicator--e4280e76-854d-46f1-b1bc-e3dde100f318", "indicator--3d1c00a4-0980-4990-a308-cb642bace130", "indicator--c7678040-e10f-440c-8243-2c707c1f3060", "indicator--40b24142-8c93-49aa-a1e5-b35749d08ea5", "indicator--c8ea911b-a4e2-4a16-9a91-3359894dd531", "indicator--1291d9e6-d8a5-43a6-bc51-c6a716175f7f", "indicator--41d1c20f-e769-4912-8c53-c816aa50a3b4", "indicator--4093df85-b093-49e5-b524-39a82e9bfc2d", "indicator--b521db7f-c585-4caa-909f-d11d1266e067", "indicator--4beea254-22ce-4862-9f05-7412c9995e94", "indicator--264253ee-b6d2-4404-9b41-0888f8142ded", "indicator--ebc40f43-8bd1-453a-b606-7cf60a2d9cfc", "indicator--d02ba130-81b3-4808-a6c2-897c0de0c81f", "indicator--e0800ce0-04bd-45db-8632-06d611f814d0", "indicator--53a2e099-0a15-48f8-95e7-1195dc914b09", "indicator--5301236b-6df5-4868-8fe8-db403738cf7e", "indicator--6e0033bd-6b29-4a67-902b-8decdd81e695", "indicator--06d9f358-5a92-4762-93c0-9d304645e97f", "indicator--fd498d61-3229-44f7-abf8-fd3a8d3158c6", "indicator--173da9c7-1a31-45e2-985b-4d3f60ced437", "indicator--b4900650-f194-4742-8f9c-7bb3edb6a39e", "indicator--736e95c3-2363-4f01-b2b0-213942e901dc", "indicator--d9b20524-f937-4886-ab67-e9dbe789a6e8", "indicator--a4809040-906a-47c0-9c30-ef8b1f44daf7", "indicator--aa679349-59eb-4c6e-b335-97b2f51da2a7", "indicator--ad543e1a-5ef7-4929-9fc3-3198e8d0de6c", "indicator--85831bc3-1e06-4682-aa5d-2e0db2105022", "indicator--621a8048-9989-4d93-848f-c8aa6fedfbba", "indicator--caea7fbb-ac79-4486-8a5c-5ffc01464f60", "indicator--1978dcc5-40b3-4069-8b38-658e9847a2e6", "indicator--dd3411db-3ab5-4f93-98b7-63da4ada36aa", "indicator--1047f45b-e927-4558-942a-7e5da5717e5c", "indicator--c43c61c5-f4de-45f9-82bf-2b6b9b730d60", "indicator--53e885a0-5bce-4d9a-bb70-c558185c244a", "indicator--7955c1c6-a135-4b8a-aacb-9a2988ed832a", "indicator--1a213f85-6989-4161-bf29-9cfd9b2c217a", "indicator--fc34b90a-4c2e-471b-bd89-c71e0e5a07fa", "indicator--11b28e10-ccbc-4070-af18-f868ee81979c", "indicator--4909ffaf-c804-48c4-b5e6-233ae647c476", "indicator--5ba82344-f474-452f-b180-98101e1a70fb", "indicator--00873b45-94cf-4030-9853-d112594a49e4", "indicator--473f7b76-87ad-4087-82a3-f0dee5d4ede0", "indicator--13e02552-1fee-47f5-9478-5f927a8d3ada", "indicator--cf9788b2-350e-4b6f-a82d-91928f37d2b6", "indicator--58288f53-388c-4ef8-9fed-746136a3bb31", "indicator--f0deef58-e660-482e-95ae-b83d99b02373", "indicator--63dd66be-2a42-47e1-afc1-73e50617d1cd", "indicator--9cd00c2f-8071-4c88-802b-d7184b00d877", "indicator--d30c5b5c-1d01-417d-b422-4edc9941ca36", "indicator--13f818cb-693a-4203-9778-805afb03e3da", "indicator--137cb117-5484-41bc-8db9-adbb66707377", "indicator--d35344cb-9c5c-463d-82e0-9ae8c16f2387", "indicator--baab5081-17ff-4c9a-b48c-dce044fb1142", "indicator--bd8d40a5-6887-4b4a-be8b-121c296d2213", "indicator--bf7480c8-9d25-4b6c-a55f-c660c305fa87", "indicator--76b433d6-3f10-47de-b385-ef14017e40b3", "indicator--8912b7b9-8557-4489-ab97-873ef8bf7482", "indicator--91249dfa-d446-4aec-8572-3743927ab626", "indicator--37d1febb-df0c-4a61-a9fc-9f0ff3f59b9d", "indicator--ab29aa93-b20d-4cf1-994d-7299e4e2ac30", "indicator--8de5d46b-7bc8-480d-9af1-ed4948f6d319", "indicator--015e165a-e2b3-4490-91f4-7ab8ad875901", "indicator--79de2e8c-87d6-460d-b146-c9b1b04e48c7", "indicator--9c256ced-b296-47dd-a722-e2ee42ed8f3c", "indicator--b00f9782-2b14-4bf7-8fbc-7f331a99e5dc", "indicator--4dd7615b-ad1f-4bfc-9cdd-b2d72bc75424", "indicator--04c1476d-7c06-4b70-a522-db27114453b5", "indicator--a5d2a290-c241-446c-b37c-5e39e1ca6284", "indicator--07185f91-92b7-47bc-82fb-9bbae82b9f9f", "indicator--bcc64bb2-7efc-4433-bd18-465dd359c9b2", "indicator--8c396f63-0f61-41c2-bad6-d0186e019fca", "indicator--6012e345-fc7b-4766-b310-999a60ebbbab", "indicator--64d6a1be-dc89-49b0-8c50-5d4e8c3185bf", "indicator--4fa5c4d7-7158-41d0-8aec-d4be5782e637", "indicator--547f36fb-805c-4f7b-b4a2-c06436eb7e99", "indicator--0a8ec5b8-447d-4200-8666-af6ede7add45", "indicator--83c3b974-1b7d-45f2-b48c-44919c183cec", "indicator--571c0fac-c51d-4387-b1d6-e5bd9b044c63", "indicator--3674bc49-eaec-4a7e-b9e4-f6b82b1502b0", "indicator--bdc75a06-567c-4a0a-b8f6-6adbb9e88b1e", "indicator--66337d73-6ea4-462e-bb88-bb7edb77f623", "indicator--558c4e3a-b1bb-4fb4-898f-6064e7fac72b", "indicator--0228eba1-a7fa-42e6-8ddd-0518b7cdaf5b", "indicator--cde87674-63ed-480a-93b1-29d77d6a1e08", "indicator--94b82daa-b718-45a5-a3eb-8a3b55acbe34", "indicator--9e727204-c0b0-4895-8c1b-2d1eb7345924", "indicator--4f4a6b19-54f2-4e18-bd00-94e0a881015a", "indicator--d739128b-ac80-45b1-a0b8-b1053d1115d3", "indicator--f54d8002-4256-4c34-b8c8-f7c7387a3c6e", "indicator--da7856bf-b60d-4d79-bf87-2fdad6f0155b", "indicator--ad3a25ba-9acf-41a4-931f-4161ac76aa22", "indicator--9723c7e2-27dd-48f8-844d-15f3f6c8b2f9", "indicator--cb471fe5-5df2-47a1-a902-65352805827c", "indicator--e2e19fbc-eadd-44fa-be97-885d76ee991b", "indicator--3cd7d46f-73ff-4969-954e-1d70e036e1c3", "indicator--9f2593c7-503e-4052-9188-2af8ad0f4bf1", "indicator--409a56fb-bc53-43a6-837c-dbe63c052650", "indicator--cf43e3eb-6924-4bfd-8a28-3929bbaf229c", "indicator--b6aede53-9393-478f-afed-59d7439b1f64", "indicator--3343c511-256c-4a92-9952-5755bd8c9b7a", "indicator--6efdcd29-33ec-49f0-93b7-6b5fc567c133", "indicator--c2ec3145-f5ad-49fa-92c6-9b80efa2e974", "indicator--86b1bf17-a53d-4790-aaa9-cd3a0a82d9cd", "indicator--0e959117-72bf-4fe3-95ae-3d4061c28928", "indicator--da2b0108-7111-432d-a357-a251a69fc8b9", "indicator--e5f6cc7d-7109-41fa-a6a0-852edc973bc2", "indicator--3fe367bd-82b7-4455-9ca4-c93d0d47a8bd", "indicator--b37cb155-795b-46e6-a27b-0f89a0506d34", "indicator--7a9f218f-7a16-4894-b287-9c4a601f8b48", "indicator--6e1c3172-eabd-4861-8041-edc0dbf14b70", "indicator--1ba87624-78ec-49bf-a0ae-24c5597b3366", "indicator--d38e8802-51a5-418a-b707-fb4a41ca80a2", "indicator--c42f8703-3bc4-4fb0-8783-bf2d7040ae6d", "indicator--20af586f-c133-4daa-93f5-f1063225af28", "indicator--8f4b808a-b19c-48cb-be24-5d02527eea1b", "indicator--ea885903-8880-474e-8d9e-f56ca35276f2", "indicator--2ff17c90-8e1f-41ef-9a8b-a7e783acaa77", "indicator--618bb2d6-7546-4617-85c5-fc89593e1cdf", "indicator--7ae9e701-2028-4bc5-b543-ea8072f01899", "indicator--5a0621c0-1950-467e-a07e-d16a4d3b6882", "indicator--1b8fb425-a2e1-4ce3-8696-fee3d019d4d8", "indicator--a9713a81-495b-46ec-9596-f8c0785b0d8b", "indicator--0b2c1f5c-6caf-49c0-9a6a-cbb10f8631c9", "indicator--0a0b4ada-f174-4fc7-893e-3db7a28d6cab", "indicator--2a579bc9-bfb3-44bb-839f-3b2dfd40e36b", "indicator--6de8dbee-bb75-4417-93c2-bd2812ad27f5", "indicator--dcd11208-a66a-407b-970f-d43acbdaaa91", "indicator--67f5ff97-a69d-4fef-a7ab-79dec3f56ee4", "indicator--2dfccb59-f163-4f47-85fe-9d6768d1843c", "indicator--357aa6a2-4d9c-4d0c-b367-afaa6c840344", "indicator--744bd5ed-102b-4a9a-a455-46d42413a03b", "indicator--5c38e8cf-58ac-4514-ba5c-91cc050b3e00", "indicator--50af1f7e-1999-4d5b-a24a-44fac7b81c59", "indicator--e55cab78-df2b-4270-93a0-b516d11930cd", "indicator--2fcf461c-9637-40e1-8662-3b9973121a19", "indicator--32e4a9b5-fb7f-48c3-b679-feeea710984b", "indicator--cfa0427a-f23e-4a17-84d5-d86a03b30fe5", "indicator--99770e75-4b74-4ba9-856c-6aae61158b03", "indicator--40a52801-3c2f-4d05-b1a5-385b2767804b", "indicator--b06b9725-8275-47df-8257-e3afe79f29ef", "indicator--d3b8410e-4077-411b-9086-8e7e137dab83", "indicator--f5a3a171-51a4-4ced-a679-c03e04375863", "indicator--23f89b11-89fc-4138-a37d-55c2777a8c5e", "indicator--eb2a3490-ae50-4834-9abb-56070e0fd83c", "indicator--7705e650-a4a2-4f14-b7b0-9699ade03fe1", "indicator--7ef96fd2-6716-427f-b863-4e438699a423", "indicator--f3396092-b2ae-4abe-bb34-19f4e0dc4ce0", "indicator--4237a841-a197-471a-b098-ef2ada33f0b6", "indicator--308f53d6-cdc9-40db-9544-5d208bc5cad2", "indicator--3646a3f0-0e63-465f-9dd3-830f0556da3d", "indicator--4a07c71d-e2fb-4933-b592-561f09707c3a", "indicator--9a15ab67-9f2e-455d-9cad-edda07f0fd20", "indicator--654491b6-c9a7-42a4-bf42-d459d88354a3", "indicator--8cf39933-eb71-4f71-8647-ac0f32af6b06", "indicator--cbca49ef-3d86-40b4-a70a-ee938144e6ae", "indicator--b1edd16e-0e98-4f49-a9fd-504a6cd5f059", "indicator--0b577850-e674-4fa1-ad58-ba677e831151", "indicator--e52a2b88-7c64-49a3-8497-b19924a9a72d", "indicator--836d7d20-596a-4c38-808f-28feb49bfe52", "indicator--7e029ae8-7389-495c-bcec-93ecf7042eb0", "indicator--1bb3d4ae-d118-4322-97b1-a6413fda1b83", "indicator--80425d78-5432-4148-aeea-8ccd78e81b77", "indicator--835f33c9-d70a-4ee7-9101-87acc7fdff28", "indicator--9acbc3e5-1dcb-4858-af58-4d08c5c2256e", "indicator--20245f0d-1a2a-4b8e-abe4-b0098f38b5dd", "indicator--e4218731-55a6-4d7e-8808-4a4db7abb2a2", "indicator--179a9ce4-bd2b-41a1-b9f2-8f93890186c3", "indicator--30ec067d-80ef-4d10-8abe-b3864301a618", "indicator--4825ab03-29bc-4736-b1a8-e9b8312e5aa5", "indicator--a2d2dfba-10d0-4f84-87e9-91bf9044b611", "indicator--648359b3-be06-4e0f-8767-b8183edc96bd", "indicator--262f1b19-add0-4e5a-9635-0365f5d8410f", "indicator--cc9f78c9-a64d-4f71-af54-ce96d3768ef2", "relationship--0ad7d1b0-35cc-40a7-9e76-83d8e593a826", "indicator--c0201a83-b234-4aae-83f7-1d0ed3485ae0", "indicator--cc0df5aa-a27a-40fe-a40e-560d5442aae6", "indicator--caa9119d-64c1-44b7-92e2-cbe8bbbbc0e3", "indicator--2542aa34-cba4-4c6e-8091-082b1fe322de", "indicator--7697cfc3-5f98-4b3c-9e51-463433745bd1", "indicator--36df2d6f-3dbe-45fd-951d-f8874e726c47", "indicator--25914643-bc5e-4a2f-9984-40842d416c72", "indicator--024b9e67-cac2-433d-b18a-fd205056756c", "indicator--59a7271e-a7e6-41be-819f-643bde529c45", "indicator--4ea6565f-ab08-4c05-b5a1-8b8131138a52", "indicator--0485d90b-8f9a-4596-adcb-b7eb103eb325", "indicator--6c5a4c16-e362-4fb6-932f-fe804e84ee94", "indicator--2b167c99-8349-477d-a700-829d01606a1f", "indicator--d55fdba5-3709-4ab3-8c24-ec747ef60a8f", "indicator--33a50cc6-bbfb-4974-babe-abff967b0806", "indicator--b4c1c854-23c3-4912-a930-eb51a340948b", "indicator--f1de7f20-c648-44fa-952c-73fdd7c3561f", "indicator--90d93814-8937-4bc5-befb-e2e1993ea714", "indicator--382772b7-a4e4-43d0-9721-bd802519f605", "indicator--7c485cec-a1ca-4fbf-900a-6a969820ed4c", "indicator--81d7f38f-7132-48ce-bfeb-a01c2b5925da", "indicator--ef2496c6-78a8-43db-a886-d440f1e44895", "indicator--c0091fb7-4772-4b31-85d3-bdd1159709e6", "indicator--6005e7f8-9329-45bd-879c-7c97cf996e5e", "indicator--c9d33cc2-ecc1-4754-b378-616a93360ef3", "indicator--6c88af83-a104-478e-8bb7-d5222febb10e", "indicator--df11089b-9b21-4ebf-a4ed-83530082ae11", "indicator--dcf9d972-343e-489d-90f7-cd335490da36", "indicator--d6840911-d0a7-45fb-bf9a-9ce31173b33b", "indicator--091036d0-4113-49eb-92ab-8acbaaecb858", "indicator--def78c61-d2d5-43cf-b0bd-dacc2f35fdc3", "indicator--499b22d7-7417-47cc-86ba-ccf2970f2b19", "indicator--66437f74-e12a-449c-a2fb-e3a90d49d20f", "indicator--45740999-d8e1-4bc5-8d3f-299db32f6e51", "indicator--80c1939e-b139-4967-8412-31df9bed80e7", "indicator--4ab3cfb1-2c83-4836-b064-2491debaf7f6", "indicator--d05a342a-e403-456e-ae9f-259ce60ffbbf", "indicator--7ba41d6d-e958-4d2c-a3c8-f32c4a5823af", "indicator--cfb2944b-647d-4c19-8a42-0859f7268df7", "indicator--b78a6e6b-9b86-4446-9237-4df06c2226e0", "indicator--b1e7ba67-4d42-4bc7-8b56-659a2bb4a1b1", "indicator--b5a7da88-3c66-458a-bf0b-49c061c1e30b", "indicator--e1d24843-5aa1-40a3-a131-424af4d5f90e", "indicator--b95d5916-f203-4365-85ad-14b7965338c6", "indicator--8104973b-fe12-4975-8893-2e6a8e9d9828", "indicator--36ccf1bc-8ed0-4d87-b45f-77478b5169cc", "indicator--fec981d1-269f-4e82-a33d-0155bf4fd9ef", "indicator--94f5a776-b5c9-4a71-ac77-76914764aea4", "indicator--9bf90725-0e5a-4629-b113-5e469135ec68", "indicator--a2d5f05f-cf30-4417-81b2-d1e3090eb8a1", "indicator--affe4e7d-2caf-4174-a9b0-6bb58d7cd574", "indicator--d341d2ab-ed8b-4d44-9155-24d910a13345", "indicator--b8361231-0e28-4446-a4f2-94017c700126", "indicator--68185905-4237-4085-8512-9bc2b850861d", "indicator--904cdf80-7e90-4fd9-9310-78bf1f79d0ab", "indicator--e171792c-a902-40f2-8ec8-61231cedb762", "indicator--d1308341-c688-4fe5-8a4f-5fa8c0d08961", "indicator--4fe73960-10bc-4831-a49d-a3959e253190", "indicator--af18be4c-a2f2-4e52-8f4a-bc48927846ed", "indicator--9dfffcf8-847f-4d95-aad5-29139034deaa", "indicator--3cace368-6a4d-49fc-9c5e-aecd92cfbb7f", "indicator--9840392a-34be-4ecf-8e41-6f32eb2db091", "indicator--ebd9d2a9-23f1-4e18-a715-8b78c156f900", "indicator--9a59dc39-fa55-400d-b9fc-59415ac69247", "indicator--f71c8efb-1a70-4d03-92da-f26a2dffbd99", "indicator--07562221-2950-41c3-9a17-81c2521da310", "indicator--fe9d5896-6469-496c-8dd8-61710e4ddbfe", "indicator--a9c8b114-a6f8-4437-b97f-01e9ebf2804d", "indicator--e2832b82-fd4c-44b4-bb86-a7471e49933a", "indicator--13f99934-a9de-4aab-b643-6f6b3a2f165e", "indicator--562ef2bb-b802-4004-9617-f486d7897f2a", "indicator--50b0d52e-e5b1-4838-9960-ac8976acee54", "indicator--ea119dbe-30a4-4072-a4aa-47d30ce440f3", "indicator--072ed90b-d3d5-46f1-825f-0fe69b6e1f29", "indicator--e0623dc9-b243-48fc-8253-61b7945f9284", "indicator--086b844b-3cec-4eef-840f-1e0d2f917f22", "indicator--a6dd1f7d-181a-4482-a98d-9fbb93494d04", "indicator--96c2d9ae-a019-41c3-acd9-38604cde85a8", "indicator--52983d67-f77a-4d34-94e6-7272e6069b09", "indicator--8a63b6fc-a569-4269-8ec5-aac76aed9b74", "indicator--609c3375-d8a2-4fdb-b200-8c4dde30697f", "indicator--960aebc8-52c2-4014-9d42-5230f6db3779", "indicator--75145f29-a91e-4c66-af21-bcfa87c3e52e", "indicator--82612007-9bab-410f-8d51-a53f6c567e59", "indicator--2945ff2e-5447-4938-99ca-ace4b3eff1b2", "indicator--79c01960-36fe-413b-b952-4ad210292b4e", "indicator--966ca0c0-bed7-4af0-a3b4-76d123b7e5af", "indicator--bca1233a-9ada-4b0a-bd71-a6be7a51d351", "indicator--3f71d4c0-dd4e-44c9-95c2-b5093674b332", "indicator--5a1645c6-0212-4779-9596-c2b71058955f", "indicator--51a6008a-d90b-472c-95dd-c996d7ad2e13", "indicator--fc4b9ac0-87e8-48bf-8c5c-c0c1ea439c24", "indicator--7031a9a5-2100-4f36-92bb-892a220826a7", "indicator--0a739eeb-04ab-4c4e-92a8-8cb9f6a1fc96", "indicator--adb1052a-e030-4a44-822d-912e10fc31d3", "indicator--792d3fb9-e71b-4e0a-be02-2f7158eccf88", "indicator--9640caf2-1c86-435f-a294-783bdfbf3a00", "indicator--19baed13-7a78-476c-bcce-a4a6db167569", "indicator--bd6d9fee-9bea-42d7-a12b-b9c963301ff8", "indicator--234cee7f-da56-4059-b738-311827e5bc2a", "indicator--6e9c0a4e-ec95-469b-b2d2-a41c00ecc9d6", "indicator--31cd21b7-cdd7-4f88-a136-486f51cc1d45", "indicator--e608cc35-c9b3-4d6f-af96-c9e73b6dd4f9", "indicator--973d527b-f782-4c5b-8228-f55029d46d91", "indicator--c50456f2-facd-4a18-ac20-b72505509d1c", "indicator--8614ae82-0ce5-42d6-8577-5787ac0515b3", "indicator--33931926-74dd-40dd-8dd2-6a945dffcd6b", "indicator--10b9cd1b-3ea2-434e-8a38-5bb255468223", "indicator--cf0f1f12-005d-4e8a-b7a2-d58544faf54d", "indicator--a312d94e-4073-40d0-9e6e-4b970777c452", "indicator--336ca4f4-570a-43b1-82b6-b951e37cb996", "indicator--45243322-3a4a-44bc-9925-f8b89c1ed340", "indicator--10429da9-f288-4966-b747-225d6e58eb07", "indicator--27261638-8859-41de-9950-419015e515bb", "indicator--d2bcec94-8101-41a0-9f3c-e891bf44990a", "indicator--03128a2d-12db-4e1d-85ee-6f3982ee3827", "indicator--cfbd767a-cb41-4f82-b6f7-55c250184fa8", "indicator--3f4338a7-450c-446b-97c6-602a4b972eec", "indicator--95919f86-4005-4d8d-a654-81aa188a422d", "indicator--de8c052a-10ca-4529-86c0-838cd3868968", "indicator--6c7bed9b-8996-4ea1-9f33-710ae702a06a", "indicator--f60619c7-6a42-4bb6-90d0-23f6c4273f18", "indicator--a0a606f6-a802-4a3b-8b6f-02be2eaeb73f", "indicator--d3459761-46ff-4098-8e4c-540e65479b88", "indicator--64a88d3c-3c53-4deb-b5d4-e26c6ffc371b", "indicator--308d219e-7e31-4863-8ad6-e9d4aa526995", "indicator--809a825b-42d2-43e8-a0a5-3b53b0103eed", "indicator--8eb14d31-f005-4050-842c-3fc9f03214e7", "indicator--835fd7a2-bcb9-47c7-8749-42ff1c43e8d3", "indicator--3b40ebf5-24c8-4969-809d-9e03e4e8b94a", "indicator--e9b40cc9-baab-4aec-8049-f2f995316564", "indicator--28b8b9f4-6078-4b50-b2dc-01f3aeb5aae8", "indicator--080a2fd0-7d03-4a8a-9b36-75fd0a993eaf", "indicator--3c352fde-aa48-40fe-9d0c-8846d29aea64", "indicator--f31c94a0-f043-4775-85af-b8a1a396d2bb", "indicator--f890a11f-e775-4c72-9e5b-754b9a60c07b", "indicator--c4aa3f06-aaf8-4ec8-b63c-48c908a552bd", "indicator--7cd89b50-ea2c-4396-85b0-ce469a4d3a17", "indicator--49f63a12-3d89-4aad-b8f7-d64cddc820fe", "indicator--a7033952-f3b4-475a-9aa1-60345390db32", "indicator--b22c3c43-70d0-4db7-9957-c8edd54ac4eb", "indicator--ebd948a1-dd26-4527-918b-b241094fb56f", "indicator--de0c4faf-16ed-4bb8-8468-7f471f8a5718", "indicator--a81ef0cf-9d9c-4125-8f62-7f311b745a92", "indicator--bf30aceb-34b0-41f1-91dd-d3c6f8f6ff89", "indicator--6acf5e56-5f9c-40ff-8260-4aead2466787", "indicator--16de91b4-765b-44ed-8e64-79e9b8789c38", "indicator--1fb352e7-e0ba-4ee3-a1a1-169906f5d4a8", "indicator--88e15bce-efc8-402b-9087-6a3a812c24c1", "indicator--b8776193-5f59-4e4f-b0c2-0c39993ef280", "indicator--d1a90308-51aa-49b7-a571-7dbddf871ec0", "indicator--44526c00-103c-4af0-b302-9c3d641b112a", "indicator--9fb6f04d-5e50-412c-b533-be732ed635dc", "indicator--311db240-b7fa-481c-b2cd-f8462b430ff0", "indicator--7b2a5b04-c84e-4a0e-ba7e-b5b27055ecaf", "indicator--811ca14a-f94b-4116-acf7-43519fc29b4e", "indicator--0bc35ee8-b882-428d-847c-caccc29b6f5c", "indicator--c96e73e9-9392-43df-8a8d-e308b23e6a71", "indicator--4a85bd43-2918-4611-9f3f-b38a4a9be3cd", "indicator--bdb9d905-9fa0-4c33-93dd-47c775ecae73", "indicator--348f475f-ddde-4f44-a2f5-9956cc5de757", "indicator--436786c7-4856-44d7-9c3f-1b1314d6a747", "indicator--21bbdda3-b589-4a6d-b789-3ee70ae76ca0", "indicator--12be6228-ec22-4cfa-81a1-86e22bf13658", "indicator--db994d76-220c-4894-94c0-4d96b82a8061", "indicator--08f6e921-56a5-4f79-8828-9ffc85bbf38d", "indicator--fe294192-121e-4c09-bd4d-1e1fe362d708", "indicator--f1dc8de2-e5ab-4acc-b644-9a3d1ae99319", "indicator--238656d4-6b92-46e5-afed-c74e1e1025ef", "indicator--a19e2274-eef8-49a1-b204-97e8f4981209", "indicator--681d6638-5dd3-420f-ad9c-f77331019348", "indicator--d46a1b8c-ed7f-4c02-a5bc-1ae3707af4d3", "indicator--795afcfb-1798-466d-bf69-74b655b0c84d", "indicator--4f590494-521b-4f43-818d-2737b22b28d5", "indicator--dde6bfef-49a2-47be-b185-02627234cde6", "indicator--671ad937-815b-4f6a-ae7e-690a8d3fb801", "indicator--352ccf2b-2ad0-4a4a-ab28-b2d1afc2f77b", "indicator--c9d2d5e9-2a4a-450e-9db5-0020cfe2b6c9", "indicator--6c7b6333-0d9b-4faa-a694-5f3f41e2d112", "indicator--7b93403a-08c5-46b3-871e-1de8a43338e5", "indicator--69faa605-17fe-4cf0-a5df-6689b810a256", "indicator--1c043cee-23ee-4bbd-9999-ee88e18775ab", "indicator--e6dff4a3-6559-4a54-b83a-72f6cf20a56f", "indicator--8ae811d1-f185-4eaa-9889-9a9d70e2de33", "indicator--90ab6038-c602-4883-8499-27a03bced308", "indicator--6037278f-2be2-4861-8ef3-88b5f42b8ef4", "indicator--435d117d-7902-47a3-b334-88e433472848", "indicator--e9304773-b555-40e1-b042-2cb641e3425e", "indicator--401ef890-3cb4-4267-b596-7e3c6596fbc8", "indicator--43515fc8-dfc6-47b9-bf71-cf67d4e2521c", "indicator--6117ea07-53e7-4681-b9e2-91dc63c5042e", "indicator--7e769227-b5f2-4232-a6e8-dfae9f69b24d", "indicator--f801ae59-72df-46a5-b23b-3d234b6ec5f5", "indicator--fad259d7-cfd3-4f8b-8958-dcfcc8053d1a", "indicator--04d7c0c8-1ec5-48ec-a30f-eacf5185795b", "indicator--b5c9dd36-abb5-44ce-939c-e78c0984e6f5", "indicator--c471d017-b765-407a-be9b-d252b65da630", "indicator--e2754d34-42ec-486a-8008-cc0500253ee9", "indicator--9a409d9d-43d7-460b-a6c7-7e994ad8e180", "indicator--7fbc10af-7497-4051-a451-8fb97c828eab", "indicator--8bcd2ce4-5739-4c1a-ac0a-9e1cb14e07c6", "indicator--42d6aa88-4d6f-48c0-8ca4-d1a40d659b07", "indicator--336a9d0e-b9bd-42b5-ad51-878ebe794664", "indicator--f90fab5d-5ea2-40eb-bfb2-fcb221179b76", "indicator--e8f77770-53a1-42fd-973c-809b82e7fb43", "indicator--fd52382e-5abf-4138-993f-264f70edec89", "indicator--0f921a4f-5e16-4791-8c48-58836787ea21", "indicator--0933a186-4e50-43cc-af70-bc284fd3fb0c", "indicator--9ecb386e-c8e0-43b3-9b39-ba3be4fcdf70", "indicator--30999571-1299-42d5-bdc5-c938811d52ff", "indicator--daa76482-7ef3-4e7b-90cc-f61fb84f3652", "indicator--30234ad1-1136-42f7-9f9a-c4ecc0785912", "indicator--37c775eb-0f6c-4785-8c1f-70d6529541a5", "indicator--5c9f4c8f-ef97-4d9c-a6de-c62693c8077a", "indicator--3676bdd8-f202-4f39-89aa-751495c2041c", "indicator--26b12235-729e-4c2c-a344-5df573b96bd3", "indicator--69cb6586-e591-4490-bb4f-9969ee035e8a", "indicator--049fd92f-7c3f-46c3-aba7-49a8f23e41b7", "indicator--288b64b7-18b8-4b06-b4fd-bd58d518231b", "indicator--892c5cce-fecd-45b8-8792-d4564b58c7d7", "indicator--c8f28075-6c54-4b11-8d24-35eec3b49508", "indicator--0c0077cb-1ec3-4204-a933-0ae4d1f6c49e", "indicator--aa9575e4-2997-49bb-a0e6-d4a64c9cd4f7", "indicator--7ae8d6a2-2c90-4529-b32a-051f7511ebb3", "indicator--0cf68c46-1f4f-40d7-9563-c6ba6a07f620", "indicator--2206885b-05b7-4345-86d4-b4bad010b0f4", "indicator--417e1f30-e587-46f8-8e37-898f2297773f", "indicator--eca7dae3-1f3c-42c2-b0f0-d3194f493343", "indicator--12ab234f-a163-4f4b-8aed-093bf57d82e1", "indicator--ab4dc09a-b819-4c03-bc7d-e5ea1f826da1", "indicator--4ae697aa-0957-4603-8ba5-af55e092bcfd", "indicator--4d873333-a9ee-4fa4-9528-d5c6bb426d00", "indicator--bf54e6dd-7bbd-42ba-9690-7723b6ea62c7", "indicator--a36915a6-280a-489e-b958-12ba3890fef4", "indicator--9e79c79d-c467-41ab-a66c-ecf359c509f3", "indicator--05ef0f96-4a38-4f8b-b4d6-c5f4e33f4aa8", "indicator--88c0872b-09ba-4813-afee-fe5aa8c94e3f", "indicator--62e91885-1a4d-4736-8823-188c1f0231ee", "indicator--e6f9d1a1-5049-4146-815d-d3621bfe11cd", "indicator--8197bd42-8a1b-4004-9a48-c9d25b3c9c1f", "indicator--eadb743d-0056-4f20-b6d2-f58e7372949e", "indicator--de892dc9-29d7-424c-bf5a-2ceba5050cb1", "indicator--12e88bd7-c1e1-4ac3-90ca-24425208c929", "indicator--c043c2ba-6af6-4a3f-8782-118e31827275", "indicator--3e89be40-05ad-4ab7-9f73-e85cb5602f3e", "indicator--cd9739f4-173a-4130-883b-f4aa84103e0d", "indicator--ddd894f0-1eba-41f6-82fd-cc68d7c81521", "indicator--581c2066-9edc-4e80-8945-5f82a2d90547", "indicator--2b5a0533-bb2f-4421-942e-25128a2e9e63", "indicator--7fb6fec7-d4d2-47d6-a1b4-c79a2ad3d306", "indicator--4389cf46-c3ec-4b93-829f-79189ce9a343", "indicator--6d0d1df1-01ff-4387-a7ba-6ee5b4d00906", "indicator--34be71f7-87ce-4945-9b72-b65de68d33f6", "indicator--558e7a55-7c7c-41b5-80b4-fe1f48637bd4", "indicator--a1c12d04-84f7-4e69-b391-035c6d74720c", "indicator--33bd6c26-b747-471b-a468-eccf4f77d1fa", "indicator--5ea5ef5f-5f39-4fff-88d8-0ac78cceeb53", "indicator--051d8ef9-b1e9-4833-8e6e-beff692f340b", "indicator--434b47b6-9f24-41b5-aff5-f6f5683d6df2", "indicator--6db0ff85-097b-43e1-94ee-cabada6fdbda", "indicator--26e18753-3a93-4490-8a8c-b89d0326abf0", "indicator--eda7320a-46de-4d15-842e-7a37085295a8", "indicator--0a7f8b42-5748-434e-85c9-33e6f1385dd0", "indicator--5ed58160-7c03-4213-ae1f-4f97b05b84e3", "indicator--f2bb07b3-ef09-439b-9399-ae9adc7ec9d8", "indicator--0a7a19ef-690e-43d6-85bc-8da9c8e4e77f", "indicator--d16e92a7-9d77-4f28-88e3-d19aed85f767", "indicator--5a248aa0-64d4-45be-9724-eeb5bc1f4778", "indicator--7d26fdcd-8c8c-49f6-837b-bda71e1e6bae", "indicator--ffc34a0a-c9af-4555-a3c8-b52c0a8f8e5f", "indicator--6478ee45-103c-444c-838b-5e1bff393356", "indicator--7aa33373-7f86-4a79-b979-f95f2aa3c470", "indicator--c1d8a0a4-aaa2-410d-8c4f-741f6dc55a41", "indicator--f0595538-eb9f-4d8e-9569-6cbede85b3e8", "indicator--4b49af48-c7a1-4a8d-ba90-dd4d9b7d27ac", "indicator--be0e8106-28f0-4498-9fcc-4a5263058768", "indicator--eed0a1f2-bdde-44fc-8cc2-f522df06ff2c", "indicator--7851604a-52b7-44df-bb59-8c10d7ef1023", "indicator--b5fa4fbf-02b5-4267-988f-ac7aa74a80f9", "indicator--9c7e04ae-cbb6-4d9e-89d4-6308ba94103f", "indicator--e69379a3-5062-4b8c-a743-5e83fb8a0d01", "indicator--84aa2bd9-3f3b-4ce0-8f9c-3c6c0f6ba495", "indicator--5f157092-f681-4f0f-a21b-92a2656bb272", "indicator--1212e650-2c69-467d-aa79-f986515c6dbc", "indicator--5c988b74-05b9-4129-95d7-6fc7b34b646a", "indicator--efa7b94e-16f0-483e-9353-2274b5e7f188", "indicator--fcf00398-bd47-4c42-85f4-ab355413025e", "indicator--293b6e44-6cb3-4260-b5aa-b2550fc0a5b2", "indicator--57fb820b-874a-4939-b7f3-8e04cca07d99", "indicator--29b9a863-3bd3-4bc5-9b0b-0c5f5b078d24", "indicator--1acca414-cb2d-49e3-a745-919876a195a3", "indicator--a37c114b-f0f5-449a-bf71-90aad6dcf360", "indicator--3c9fd915-a79f-41a6-99dd-91e39789bf5e", "indicator--28cebb79-0f36-4d64-958e-1e888393a0c5", "indicator--f7594674-874f-434d-854e-0c149197102c", "indicator--4ff872d2-8aec-4663-8ff8-d1bf1bcd53c9", "indicator--f22bea01-d282-4bda-9434-8ddca508b380", "indicator--a8b0a0ab-0e43-46c1-aca2-dd91a5730d3a", "indicator--501d6e6e-7f3d-4220-b07e-b2fd3cccb87c", "indicator--0659d66f-7642-46df-9218-a741998f537b", "indicator--f0e9c368-152c-400e-85c7-549e3a0669dc", "indicator--5fccfdb8-5a61-4293-a5eb-7213e9535ce7", "indicator--20ce58f5-a239-4da6-83e5-394c325c0aac", "indicator--80ab61b2-061b-4da0-828c-610c04bf4443", "indicator--a6b40bc4-9b03-49b5-a54e-ad0a0c206fc3", "indicator--6212722a-bd67-4b9d-bc55-4dcf53af9b42", "indicator--ccbf53e5-b5ba-4b1f-b0fc-ec0dd279e385", "indicator--7b8b2e66-013f-4684-8311-57e95e7c7de9", "indicator--38f9b123-cb9a-4543-87f1-4c597a5d2074", "indicator--f115111f-e02e-4c46-8db6-87d064a6390b", "indicator--f8ab2973-e626-4238-a7ce-4bbe107f9888", "indicator--93e85e2b-cdb4-4417-8903-dd0fb6e2474c", "indicator--c153e797-db5d-43e7-a1b3-4cf0077739bd", "indicator--6393344b-0fb5-45ff-a5a2-f357c796af47", "indicator--417b2908-50fe-4acd-8b9a-08b95023cbbd", "indicator--20101229-d536-4a6a-b41c-8345b474babf", "indicator--44830f51-1c9c-45e5-9f22-f18c550ece33", "indicator--02e1935d-f4ea-413c-b32f-b19d8b2dd247", "indicator--bbb35304-e9b1-4c37-9993-025037f104a4", "indicator--1bb8cfde-df03-495c-8165-cf1b1d7e4478", "indicator--51c1a183-7376-46e5-9b9c-797c81a06ebe", "indicator--3cf3d3b6-87bd-407e-b374-b9a9fb724f06", "indicator--ef8f4459-bfa9-45b8-8594-b7d90360d2a5", "indicator--f032b57e-6e18-4b42-a4ed-5dc0ae518317", "indicator--4e83e32e-0887-42aa-be47-27a5434b91d2", "indicator--90a4a2c8-b206-42f0-b254-4e31b59c99d7", "indicator--74024221-350b-4da5-be2f-fb3beac2a421", "indicator--5ebc36f5-c6bc-4053-83a1-a073b5d00e29", "indicator--8b6312ae-07cf-48ee-bd92-a28080edac99", "indicator--4d263e86-eae8-4974-93fd-3d9e7bcb92e4", "indicator--cc2cf030-62e0-430e-b091-340887f80746", "indicator--a8c070b4-2320-4e46-b7d3-52a9a0219e29", "indicator--b2dc540b-3e0a-4c33-acac-e2699d176445", "indicator--a6478400-a27d-4e51-a6eb-c0fbc8bd5d89", "indicator--9d635f8a-ea9a-4300-86b3-a9acfdb56896", "indicator--e56c792f-67eb-4f9e-85ce-0bd4e5e215db", "indicator--d1d23492-01a2-4db1-9ee4-e9040d0bee51", "indicator--0a1cc0e9-8984-4ff4-b97d-d7db66a501a4", "indicator--43c80748-2ff5-4a3e-be3b-dd5c11875226", "indicator--6de5e5e9-427e-4925-836a-6d7725715dd8", "indicator--df22156e-aced-48f7-be6b-de72a7a253eb", "indicator--36199cd1-29f7-47b4-aff9-050bf45ce82b", "indicator--9d413a39-e7b4-4bdc-9813-35a1658327b6", "indicator--b5190f37-ea32-44c5-b6a4-465bcac7c641", "indicator--16a26174-1269-4fc0-9d97-4b667950aaa0", "indicator--7ab54bc1-656e-4efa-8688-34bf51c4ef82", "indicator--adfe5c29-b0c1-48d9-955e-222ef18f717f", "indicator--da035ee4-f71c-4c82-8085-85e119846f7d", "indicator--09445c7e-df6d-453c-873b-db7c245a88bf", "indicator--37ac1654-e581-4bdf-b2ca-0e9b3bf26fc9", "indicator--686b12a7-37cd-4a32-9b91-bc65c5f74894", "indicator--7460fecf-dd47-4777-a859-5d5536468238", "indicator--2d1d17bb-09d0-4d13-96b4-90c932afe611", "indicator--150bdf3c-9d06-442b-ad03-55d1b318a278", "indicator--5c0ce804-5453-4710-89f0-4db4410be8b0", "indicator--cc7f0157-0b77-493d-b80b-c471a68f647f", "indicator--9e9890dc-35f0-4779-adab-7bc4958dbb54", "indicator--ec2523a6-30a9-4d9d-8418-649e2f1ea0fe", "indicator--cd6c6007-36d3-4a01-90b1-cb6e0509d40b", "indicator--2eb811bd-ada0-4f0f-b44c-75cf8c8700f0", "indicator--fac40d23-0a2c-40bc-8c8a-096d330b8f26", "indicator--ee19bcbf-8808-482c-8dab-edfe063e7d66", "indicator--3cf5db8b-1377-4b26-8601-3dbc6a48f53d", "indicator--89684384-cdcd-4c45-a956-0e13eeecb401", "indicator--e372eea4-d44f-4a55-acec-5eadc980a850", "indicator--ac7a9bf9-ed8b-4edd-a744-0a03813c571b", "indicator--3560fccc-6feb-47db-a650-fac26e4787ac", "indicator--62e52318-383f-4ce6-9ce1-6db7d324ecde", "indicator--be83e774-8454-4f4f-9b87-57db2ec87e7a", "indicator--04fd9360-5713-4f51-ae5d-ab112d33cdc4", "indicator--bb549fdb-3bfc-4057-aa48-415fd5617606", "indicator--a4544f11-18f6-430b-b5fa-e92499494726", "indicator--274a8419-fff6-4093-9d1a-c8e91b7891f0", "indicator--c75a939f-c6a2-44df-b939-1388f1f5e780", "indicator--dd49b006-c6c6-4d14-ab40-032c795b08c4", "indicator--030873f4-d71a-48d4-acee-09d8cdb0cbef", "indicator--c9d4e667-a208-4ce8-bcf7-6998dea54dc5", "indicator--c34c4141-8b94-4771-b793-9bdbcb1a9c0a", "indicator--44d5de22-ef73-46e9-a9e6-1a43e1d06668", "indicator--d4cdf3d3-0891-44fb-a00c-8cfa271bf313", "indicator--e0733edc-fed1-4da5-b4b9-157f07e2aa62", "indicator--7c0a75a9-9e6f-402d-af23-cbc046dedf13", "indicator--af7d27b1-cbc0-4d54-b5c4-8b8b4365f780", "indicator--de755c6a-4a2e-40b5-8635-8a70d82a98ef", "indicator--64647802-75b5-4ea5-87e9-87bc3c77dbf7", "indicator--3b228213-4e89-4f9f-b945-59949bbfad7c", "indicator--bd90c78d-466b-4974-8e97-6812a3bd4a32", "indicator--16660ad7-d802-4454-9cde-b209fbfaa877", "indicator--c28880b7-1c2a-41b7-8e82-b4864df1199e", "indicator--a21fdd9a-17cf-4088-961e-65bc35f0b5c0", "indicator--2e0a3b07-7ccc-4c82-9331-1530709c460d", "indicator--ed9bd39b-0ea3-4f06-ab2e-2f68752e0864", "indicator--88ce5a3c-10e9-4706-ad47-0cff511a9bed", "indicator--0bd9622b-a4b6-489c-ae75-4ec64cd36f78", "indicator--040aa470-72c9-4124-bf98-f8515535c319", "indicator--9459397b-8581-4ce8-9368-e3f5d320153f", "indicator--99e9d6fd-712d-46ee-a246-6d1350ea1018", "indicator--a4f84721-ca1d-471f-a24c-ab298c679718", "indicator--6c644abd-60f2-41fb-9db2-4f733af8ac32", "indicator--1a85b0a9-5bb0-4159-ab11-1dde72f64b29", "indicator--2c179c35-df1b-4e87-bfc8-9676c75caeeb", "indicator--b13d68a9-21bf-4d05-84a0-44e0272ffd94", "indicator--41180880-518e-4220-bf86-978dd155ca76", "indicator--6e53a479-0fe8-435f-a2f2-181531e5a54a", "indicator--8b80f657-a8ad-4903-8d46-a9dba072eac0", "indicator--afad71a7-0417-4daa-84be-8c17625c2955", "indicator--51798ab7-c921-4765-a839-a71ec85dbc05", "indicator--42d95c04-c863-4f23-944d-6b3b6403e237", "indicator--6922398c-5f57-4f0f-9fb8-de217ceac478", "indicator--22e84357-4eb0-4c42-ba4d-46fa56b0e6d7", "indicator--0aa7d2f4-d2c8-4346-b8dd-13f51b2ac4af", "indicator--fd917e69-69bc-4143-9e41-c1b4e9b822ff", "indicator--cd42ab36-eeec-4c31-8ae8-72ae2ffdbaae", "indicator--63bdd883-5fb1-4dcb-a1df-29028d1e8a70", "indicator--8500bbeb-21a9-4212-9081-32687a1e322c", "indicator--e5b53fa8-eb5d-4a41-ad96-c1550f0409f1", "indicator--cb424fb5-8f92-4c02-8e9c-7dda1c2bee67", "indicator--ca049751-8039-4f96-b075-38e235e1d5f3", "indicator--24a2f9dc-c863-4fcc-908e-5549ae00cf7c", "indicator--961e6f7a-eac4-4d15-80ec-899fe8c265b6", "indicator--282ffa02-e470-43bb-9305-557db3e39559", "indicator--d3cea376-7135-460e-afb1-5c13a1012942", "indicator--4acd9cc7-35ca-41af-b560-bc8197250bbe", "indicator--41788524-8e4b-4462-8442-2d8991e334a9", "indicator--64547b6b-2c89-486e-bf85-41b8a1e46aba", "indicator--46c709c9-8cdc-434f-861b-7a934c311c25", "indicator--12626c78-2a25-4e92-b29b-1cba5537df64", "indicator--630ecfff-cc15-4310-86cd-f16727d57fb4", "indicator--e198b269-a9d8-4c2e-ab29-9a8811fe14bf", "indicator--14803a77-5589-4870-9c0a-94627e8031d2", "indicator--64075f62-a931-45d5-ad7c-c4c347a26dfd", "indicator--d4480733-c436-4d3c-b4ab-367298766dc4", "indicator--5e89250d-a263-4f4f-9ba0-102db8e2ca7c", "indicator--bbf4ed77-cf63-464d-9fdb-3de7136df404", "indicator--8bcd38a8-888d-4d63-85ec-c71bd91a37bd", "indicator--f52057c3-30ad-4fbb-8596-bc29e4dd2891", "indicator--02467ca4-2806-4586-90f1-425a905b39af", "indicator--f4350bb2-13a7-4d69-ae57-c4906eeff0ca", "indicator--607806ab-c080-41e7-b793-40bce4ced114", "indicator--cf510093-a1a9-4d26-8e5b-ac0a0c86fd4e", "indicator--945e660f-0332-4005-a753-fa9e2d13ce46", "indicator--ab47ee10-6dea-4184-926d-9b4aebcc1b2e", "indicator--c9913180-fbe6-4fea-b342-f852548d1219", "indicator--630d9bba-a80e-4375-8e9b-b47c3a5f67c0", "indicator--52b390ce-23ef-4054-8654-b1b7e4c5ba69", "indicator--c588f3bd-bb29-48ca-964d-aaeb2c5ffe50", "indicator--3dd18669-6e84-4788-8467-d1b355aac4ca", "indicator--4adf4626-7a5c-44bb-8c06-f2f74e9797d0", "indicator--6af6165c-0136-4de7-a722-693b1729f9cf", "indicator--882c6231-7b17-4d61-a838-c59f43b568a5", "indicator--b17c1743-e019-47e6-a6e1-76ff07517cbd", "indicator--b5dfda0c-0bb8-4671-bdc1-e98c47b65a94", "indicator--87bcbcef-7150-4797-b49e-8615fdba7dec", "indicator--9916acc8-cd3a-4b34-b5f7-e35ddfa45913", "indicator--73dc2b49-ad20-4993-8c7e-bc7151edeeed", "indicator--fdfbbb5e-685f-40e7-924a-84ec3e924f84", "indicator--ca37794f-f350-44aa-8dea-e3cfefd4dd7d", "indicator--55f2914e-5d5f-4d7a-a37f-3d94b63c2798", "indicator--091f37f5-bbfd-422c-b3d3-ab38beffaca3", "indicator--915b4527-d852-424c-b903-d7dc69218ad9", "indicator--d84dc799-bbf8-440b-b229-72c699f01280", "indicator--0661ea24-7ae9-4036-bb4a-adb39ad014ea", "indicator--ea77a003-3130-4b47-87fb-e00dca12d695", "indicator--83564cd8-acba-4d75-a810-8518d1cadbfb", "indicator--5981f98e-dd8a-4923-8d79-70db95740df8", "indicator--2e26d046-d7db-4e5a-9fc6-0deae8e2fce5", "indicator--b40ac746-37ed-47cb-bbaa-2ada4dd83111", "indicator--5fd8c953-7b0d-437c-8344-1b3c62d6d2ae", "indicator--904ce209-81e0-4ffc-a614-03ab53b7d4d3", "indicator--82a191f7-4d6a-4a0d-b0f8-ef972b0fa7bd", "indicator--fdbae1ba-699d-4431-87a6-f2bd29a58da5", "indicator--f0a7045c-35c8-4311-a5d8-eba1f6bb142a", "indicator--84d04d58-8418-41fe-9cce-8eef4d2f85ff", "indicator--2fa64bb9-aaef-4c17-8d7b-451e6c35aa58", "indicator--7f653cf3-5aec-4e11-a3f6-28a14484391e", "indicator--3170f6c6-c115-4b05-8f6d-a3d1f1d20f44", "indicator--a1888d3d-cf2e-4c82-940f-f52a1fc634e5", "indicator--3e816394-fee5-455d-bc6b-35bf2c1bf90d", "indicator--2d5b37bf-df9c-473a-b228-9c3460bf2e6a", "indicator--51b67849-3333-4d36-a4d2-024bfae018ba", "indicator--e0cbf0b1-8e44-40b3-b1df-0f6fe34e0ace", "indicator--e30904ff-fd98-40cb-a57e-d976e6bb17ec", "indicator--db303a58-3ab9-4384-96ee-ff72195806e1", "indicator--58bb8006-fdec-4e8e-a102-f3605de35abf", "indicator--72c3846d-f673-4b12-a704-f17792caa0e1", "indicator--91e2ed9d-7aaf-4f96-816e-30490619892e", "indicator--2c85c8f1-9225-4ce2-bcc9-c368ff8bd29c", "indicator--8f2e8ae7-e82a-4b24-8862-13b4fd5d48ca", "indicator--e6310092-3dbf-4491-a1cf-fe550d061c3a", "indicator--700f92b9-8b42-473e-8f74-b97efd309f03", "indicator--d9c8b01c-76d5-4fc5-8c2b-130a5b3b82ba", "indicator--34d60425-fcff-42c6-b6f8-e7d89dda78a5", "indicator--5e4ae9ba-3512-4c58-910d-f059f03e8ca1", "indicator--1ba2e1b4-acf8-4116-b518-540c537a210b", "indicator--7e1d6fde-1b5c-4ffc-b71b-88098bfa33f1", "indicator--942fee6c-59ea-41f5-9012-1bc9f0626964", "indicator--e8a32372-ae49-404d-a458-cc5d14e7d76f", "indicator--860c1289-6329-43c8-aed3-dede7147f2d5", "indicator--9f4b6416-09ec-4d44-bbfc-e549fde5e301", "indicator--a4b93b23-89af-4b41-a23e-31721e2f34d3", "sighting--146ca359-8147-45e7-93e5-9224ad3c532c", "sighting--3c52943c-54d1-4810-946c-6349ec2a0fa8", "sighting--b31bb7f3-bbd5-4f50-b3d1-9f9c86d949c4", "sighting--b20443f0-4ece-4bf8-893f-8750fe5dd3bf", "sighting--97f8695a-37d8-4779-b700-9f5fe2a000a3", "sighting--a8168cd0-a8f3-4f21-997a-4a3ee6fc443c", "sighting--3f5b4eb1-21d4-4eb6-9cb9-0412ec622879", "sighting--9ad185f8-47c0-4880-b3bc-c63ed2877f33", "sighting--dd1eb8a3-de1d-4606-ba0d-7f911559767b", "sighting--5be46868-c81c-45d7-8c17-23ac5b250b69", "sighting--e71b06c2-c922-4eea-bc00-3c614e4b319f", "sighting--fddc6442-9d89-48a6-812d-45274114ace2", "sighting--ba3945eb-ee61-4567-9072-284537fde70f", "sighting--8ea4cc3a-62c6-4700-b90d-2dfca9b48707", "sighting--e214fb4f-971b-4134-9955-f1eb42202b03", "sighting--570caca4-8125-432c-abd6-64ef6cfcc575", "sighting--804fce1e-237d-43b4-a01d-8995f8098dcf", "sighting--b47edd0d-00b4-41ad-910b-32913cf92383", "sighting--d5ee56cd-df27-4f74-911b-16078eb786a0", "sighting--7c30576c-af64-4e6f-81c5-b0ddbcb03c54", "sighting--c08da75b-6f01-43e4-8924-c4f5be77466b", "sighting--e8a95635-5a8c-48ed-8dfb-707411ffe7fe", "sighting--93e82614-0cf2-44e5-afc3-41a285f79e01", "sighting--b48be630-6945-478e-b501-36b061978500", "sighting--b8fe5b10-6567-4790-bb75-87a80dc068af", "sighting--5bb7aa10-03eb-4aa7-b05b-20b510cb9719", "sighting--7af4b78e-1f33-40bc-b797-1f54baea3c38", "sighting--8e9897c4-c740-4c6f-96ac-553c6c12a2b4", "sighting--60452bf5-9c7b-4a1e-b010-eb1ffc92c345", "sighting--9ec787ae-6d84-404b-884f-f945e8cbe67c", "sighting--90cf715c-5ad2-4c2a-affa-2e04641bcde1", "sighting--ba4ec54e-02aa-42e9-bc9f-e9647c55dc06", "sighting--db23fb7c-c2d7-4380-b742-f6d26412a629", "sighting--53a143ab-be08-4c7d-ae1c-f5cc82b68456", "sighting--03b00bd0-c3a4-4cdd-891e-cb132abff9f8", "sighting--f0bfdc18-3b08-452c-9fc1-4e9717fe19c5", "sighting--f1f67309-c36b-4bc6-b0c0-8495aa3ed32c", "sighting--6c6520d3-4a29-4efd-927f-95c974199f72", "sighting--4ef08e9d-20d5-4df4-be2e-0d2d7b980eb8", "sighting--e74142da-f41b-4b93-8b0f-0fc6def59bf9", "sighting--debe9fb0-7133-413c-aa00-302ee19c9bdd", "sighting--c05982cf-2a92-4ce6-a419-248ee0fdced2", "sighting--727187e9-f803-4e79-a5e8-9291e3473db5", "sighting--0ec8af4d-31fa-4a8c-af9d-d88fe5e0f179", "sighting--2b2f5319-beae-4602-8442-ee6fee7712b9", "sighting--2033e2a7-77ed-463f-8cc5-6969b5679450", "sighting--006b9f83-c888-481b-a9ec-3e4a14f789b4", "sighting--3c1b1a53-6785-418a-97c3-8dd10c3be453", "sighting--12ab0b53-5d58-458a-9b1e-1bb0b0b3ce4c", "sighting--794114d8-798c-4349-b74c-3110d4eea2b5", "sighting--cbeb20d0-ca84-41c1-80de-efa3856323d3", "sighting--f68ced4e-ed15-405d-bcf1-8c4ec8675edd", "sighting--5de62fd7-3301-445c-9cf9-7cc6e4ae1dad", "sighting--da9d2f68-dc65-4afe-b41e-bbe75a8fd750", "sighting--d6c75742-8385-4481-9675-79c689d75ac8", "sighting--d582d80f-40cf-4924-8a47-232b07679e5c", "sighting--4d58270a-4248-40bb-9d96-c482e62e81ef", "sighting--7c31d7ad-a462-486c-871f-b03a6eeefd8f", "sighting--8eb379ed-86d6-4af4-9980-9307cf05ce4c", "sighting--4fea8e93-8708-4446-9160-9d6f7172ccda", "sighting--426c38d0-e6e2-4f10-b199-574f555a6e63", "sighting--12f62ae6-1d80-45df-9a68-b7caa7693452", "sighting--d10c68a4-83c7-4089-9f3c-e88e58e2fbaf", "sighting--1746b383-2aa4-45b5-af0c-be19bef46eca", "sighting--6299958e-9714-4f5d-bb37-c1bbc0b589d2", "sighting--468cff1e-f805-41c4-8c1d-ce92cb43cf2c", "sighting--e53f6c99-7d53-484c-b9a1-93733ba8ea35", "sighting--ead2ca13-8c2e-449e-95d8-8ca7b3e29aa7", "sighting--5887d1bd-443f-46aa-9e16-474cc9bab2bc", "sighting--d0a57788-a12f-46bb-881e-5e608c508270", "sighting--ec7aa7b9-3395-4844-9062-2aeca7892b59", "sighting--30225082-de46-4f8c-828c-a1e97f52d722", "sighting--c2cfb83b-e302-46cc-8685-50b9db7903af", "sighting--d4d84c6a-98de-463f-bec8-96028f8b0f2c", "sighting--76b5ed19-3c9a-430b-a8ff-5fd0c79b719c", "sighting--b018f252-3609-4fd7-a711-3f59848805dc", "sighting--20e01152-6bad-4633-84ff-f9403e147d75", "sighting--c2d8a104-21a8-41e1-bdd9-afd24469b229", "sighting--b11489c1-9e69-4674-acb7-4c8408e54e96", "sighting--b2d32c9e-916b-440a-8f9d-fb9ecbf7fa56", "sighting--89994c7d-a0c3-4c15-8955-62b1c6d74b2c", "sighting--f689203d-f7cc-4b77-b874-dbacae72c57f", "sighting--2e2fa871-cfed-4898-a013-0e92b6c25640", "sighting--9dbf4c65-91c5-48f1-bb41-0d4994a60e4e", "sighting--c6b6afa0-e062-451c-9f0f-62b13a95fa7b", "sighting--fb91ee5b-10f4-40bd-8b77-47a59472dea9", "sighting--a75a47ba-adbd-4b18-8e3f-aac391bfd22f", "sighting--673c0170-abf4-4957-8e6b-2dc548b0dd3d", "sighting--e9e70355-4917-4eaa-a420-f327a1a61940", "sighting--df3e8d00-b44d-4e9c-93db-bd5e5f3ebfd1", "sighting--99b5588f-0f93-453b-8119-397a412f0023", "sighting--87a70bfb-eb48-466e-9c05-890e3579db5e", "sighting--6ceb6548-92fa-4a8d-9c5b-2c28ba11f60e", "sighting--b8aa8453-c7c2-47a7-bc9e-0befd094d0d7", "sighting--1e0325db-f36e-4252-ac0c-4e0dff9b06a5", "sighting--f94e4fa5-0ccd-4d65-9a90-8a19cc078260", "sighting--bd0181f1-16e1-4236-a380-98aab4a5a394", "sighting--93421876-15d7-42e1-abf8-cde8b3536677", "sighting--af00a5ef-fef9-458b-8772-7f81b10ba619", "sighting--463f7a65-65c7-41b5-acf0-1cd6572c77d7", "sighting--8e81f1d4-d4e4-4995-a11f-48293c8e9f29", "sighting--513e747b-83f3-4c6f-af7c-ddb223d1068f", "sighting--1379778f-cbd0-4c88-99d1-d7c8662c7f6c", "sighting--492582a4-9b1a-40fe-88c7-56bf6267ea03", "sighting--9faf3c75-8add-4d3a-873b-476f4b1e5f1b", "sighting--0e2404a6-dead-4529-be9d-638730ef6e66", "sighting--88782a71-cd7e-4a42-b523-59739492a981", "sighting--507e9bbb-1135-4591-8440-5f504dfb85fc", "sighting--a2c7b7f2-2f4f-4f2e-a7d6-65ae83673b75", "sighting--b13f470b-9c67-462e-ab39-63e093abd727", "sighting--6519bb57-3e6f-4e9a-a08a-3047b0777588", "sighting--cfc22d7c-e7f5-4bca-a2aa-f2adb712ef26", "sighting--186e464c-f268-45c8-8a08-1eacf675a033", "sighting--173c05d3-a34d-4a2e-ba75-15f2a2f0d473", "sighting--336749f0-0a0f-436b-92a6-f7d309a096f9", "sighting--a3ae7a98-89df-4e5e-9154-c42b625d4e16", "sighting--1d1bbd45-0de1-476a-aede-b60e487a331b", "sighting--f728274e-affe-43f2-83f2-60dd97f86d55", "sighting--3234278a-a3fc-4de8-a06a-c06b1a8190ef", "sighting--aa84ff43-9352-45d8-9879-3da7f22d5a73", "sighting--1f780958-9776-4d8d-9fcb-b031be7e1ac8", "sighting--296fc473-dd28-45c8-8e88-48a1b6588cc8", "sighting--5aad5935-8d20-4f0b-ba09-8a269e68570c", "sighting--cd5ece3a-3d53-4ae3-b167-d8f49ed2087d", "sighting--14d0b82a-b2e5-445b-87c7-94d1cf69ea3d", "sighting--5fd6400f-354e-41aa-aac9-c6a7083d9c9f", "sighting--4c6154e2-0fae-437a-84d6-af3c380c17d1", "sighting--27a4d5f7-9edc-4de1-97f4-0c0b9ef2d4c7", "sighting--2b98ed77-c9a5-4dff-9d7e-8d260fc0e2bb", "sighting--95556d09-6238-4bd1-bd61-a0f804f3b33b", "sighting--533abfd5-848a-458a-b988-4364fec3dfc8", "sighting--5c18d1ab-c7de-4d31-b957-dc1028623dd8", "sighting--7d31433e-6f1e-4c0d-a0da-88c127870782", "sighting--e6ef2548-acbf-4da3-b124-3c68475af70e", "sighting--bd75de6b-983c-4358-a906-86934a88c82a", "sighting--616679f4-108a-43fc-adc3-3a68a784eed3", "sighting--ee2c5808-a618-4137-b8c4-ee297a703af3", "sighting--25db80a3-631c-4b49-b1aa-aee9ffc37bcc", "sighting--96c929ec-e9c8-410d-880b-a8dd3c612e91", "sighting--0822e2df-7750-4606-83ab-13b2824363da", "sighting--86c68274-361c-436b-8298-33f4f85e03d7", "sighting--041535f4-bd21-4493-aae5-a0c0fbeb6092", "sighting--68067e44-aff2-4001-882f-020d4e9543eb", "sighting--2481797c-4771-4530-94fb-d83447dd8ae4", "sighting--163c3dec-4d49-4883-b3bd-92ce08d3f6fe", "sighting--3b2d78dd-0d73-4b53-b574-552710978bda", "sighting--750618e0-e183-459d-a6a6-3ddb28a0138e", "sighting--d68893a5-2f91-48b8-b97c-8a6bbfa8128c", "sighting--c4687472-ea87-409d-9541-183c63cfa55a", "sighting--b85802d3-c04d-47a8-82ce-712f23debde6", "sighting--f86c715b-c5dd-470d-9729-d4f1fd3f4bdd", "sighting--1ce55521-fea0-41b7-9828-225125bf7b57", "sighting--1c452434-a825-41e1-944f-c4c4f480f429", "sighting--eb0deb96-f7a2-4dee-8fbe-48a4b3e529e2", "sighting--c19b4303-b571-495b-8e2e-ac1943a28cb2", "sighting--6e19ade4-d111-4577-a0a5-4820608c2a61", "sighting--fd529cb5-93a3-4b94-ad9d-2255cfdbde76", "sighting--7e4d161c-be22-405b-b862-db1305354a34", "sighting--3f17b166-a024-4d0b-92c3-78e5d4c56ac4", "sighting--a97c594e-ddd6-4b56-aa25-313f2c3e94c6", "sighting--5987bcd0-2fc4-44b0-850b-16d4eadffd2e", "sighting--3a2e0d81-9d23-45e8-8c09-649c7e1ee9ca", "sighting--d673c2a5-c2b8-44f8-9e4e-0a4170af2a5a", "sighting--fc394691-09e2-48f5-9c87-3ab8f0a68b25", "sighting--94164c92-64e0-46dc-9a07-b1edf70a345f", "sighting--aa007692-9313-477a-8e4c-0ae91b7542dc", "sighting--e559d725-c8ff-46c9-a250-2351076e02c7", "sighting--cf11e4b2-0e6f-4049-b23a-3578b48915e4", "sighting--f4406edc-7089-4d27-a0bd-6084550686e5", "sighting--df0fe1fa-689c-4a83-ae6d-f2def9994f1f", "sighting--1e0f3a6e-b80f-4c83-b573-4f23c42c1d62", "sighting--45707b6d-2362-41ac-91ea-57847a82260e", "sighting--83f44599-9008-40f3-a8e1-b5973a4b25e4", "sighting--dff94679-cf42-46aa-92b8-368365bb0f4e", "sighting--d612dae3-9057-47bd-b179-7c9e12e92f0a", "sighting--ba3ed4a7-1582-4923-87b2-83e564404f81", "sighting--957302ee-a107-4b8c-b615-9bf8713f482d", "sighting--4ae5599d-8343-42f1-a5c0-826ae73eb568", "sighting--4650fe3c-4b4b-434d-a26c-d1da1035b3b4", "sighting--c2eb0ef7-4c81-4ff9-9375-c12b7a23bb17", "sighting--117b28eb-951d-455a-b82c-5f10c55ddde5", "sighting--c91f7ffe-389d-48dd-8cb8-9df746f33648", "sighting--f4cb0d4e-348c-4317-93f6-a8293eb96ef3", "sighting--3c11bfa1-0f3d-43cd-9624-7c435c4a320c", "sighting--244ddb97-4a11-4543-82fe-94e952379b4d", "sighting--5ea1e56e-8b6a-42aa-9862-4aaf997f1c99", "sighting--e3782d86-b8c7-4d72-91ac-6ba1174501af", "sighting--c50c19ae-6272-4dd3-9b68-302c3a6c4ae5", "sighting--e74002f8-1e84-426c-bb42-d3a272d9cfc9", "sighting--537a44ca-d702-4d36-b57f-710def238fbe", "sighting--571e0068-41ce-4491-ac46-bbc316f1b3e3", "sighting--66d06e9e-d416-4b16-b445-e189d03338b0", "sighting--7ca32793-4d93-4408-a18e-a87d1bd5e26f", "sighting--bb7db346-04f2-439a-8ae0-6e5445fd95d2", "sighting--7b963ca0-4ba5-4bdf-9ff3-98e0c4b89ea1", "sighting--d2830089-16a2-4a49-9df6-6ecf4f723aaf", "sighting--c0670584-235a-447b-a08d-ed11e3bde895", "sighting--6ba2b96a-2a86-4d43-8983-aa1b0f203566", "sighting--d7c8e89f-e666-4940-9937-5a5805194f0c", "sighting--45568371-cbd1-40ba-bc01-586202ffd405", "sighting--48d56927-e773-400c-aabd-25a0a75c92f0", "sighting--96a6ebc3-0140-46fb-bd28-9ab6e78759f4", "sighting--7b2ff392-b886-4493-b281-d6ff6c2d9cb4", "sighting--69535739-7e3e-430f-a5be-f06a2c94198e", "sighting--8f3b1c0c-edb4-4dd8-9dd8-a683fe2c8fff", "sighting--c0714dd1-1d5f-4c35-b2f0-4b5362b43bd1", "sighting--cbae6063-15d0-4661-a465-18bd70cb1f57", "sighting--68b95dc3-fa41-4ff0-ba7f-10337d859a49", "sighting--46c69df4-fc47-4341-86ea-9aa9d2422fb4", "sighting--75d407af-3893-492b-8c07-369de978e086", "sighting--be29aaa4-3a2e-42c8-ac91-91341303ba10", "sighting--a7832663-0adb-44d9-9746-0ac4ce0bcb18", "sighting--abedca3a-02fc-401f-a7bb-422a4c1a2f6f", "sighting--02e7e141-7e3e-44be-a935-2af7fe52a1ad", "sighting--cd81d94b-54d0-455a-965b-85d4d1584b2a", "sighting--42c455d6-5ced-45c8-97c3-f23f80195ed9", "sighting--3d6ac217-9ae3-46f2-b33a-e5b497c71f41", "sighting--046ac96e-aed1-48e9-8180-029ac5cd18a6", "sighting--a4f411ca-29d5-4a6c-88af-95d9ed6f7389", "sighting--e2ac88e6-fde4-4063-90bf-214231f29f2e", "sighting--e5e753ca-d7aa-41fc-a4ba-8d9519e0df4c", "sighting--cc530b9f-3bf3-4111-b4e9-88e892e33117", "sighting--6e5b00de-d5fb-4d3a-9d9b-48fe8a81bed2", "sighting--c3b84803-ce03-46a7-8996-6cce9fcc4eee", "sighting--480a548d-b51c-4d3a-b9d5-425bd05e0de7", "sighting--4d67d007-edbe-4ca9-ae7b-6e582e9d7cd7", "sighting--2be7d1c3-d18f-459d-a281-7f362de8e03c", "sighting--6f324bab-508a-4c48-9dad-a0a0f11755f5", "sighting--f8a3f81f-32ee-47a5-b2e2-b95fca53373a", "sighting--cbe32bd9-002c-42e1-ab6e-8550a8901062", "sighting--ece2d0de-1aa4-4330-90af-273435ecc4ba", "sighting--0dcd22de-2794-4b12-bb9b-b23cf12c5c54", "sighting--2ff52abf-bb04-4bdd-b613-eee25f13c163", "sighting--c10611f5-fd85-4bef-b1c1-bdf317b48ffb", "sighting--735fb682-70e2-4523-b754-b438217406ac", "sighting--62a253c7-8369-470d-9b1c-9ddf4b9bee3f", "sighting--613cb7db-d6ea-4ea9-834c-d8e430dd0d9b", "sighting--e3c19eaa-949a-4267-b6c8-b302578a9bde", "sighting--8d5be3db-2175-4d54-adf1-17dfc1bf4eb9", "sighting--6732960b-b550-4831-850c-411066e98637", "sighting--b44d26d4-fb4c-44e1-ac15-7563056f10a7", "sighting--9fb230bf-788e-4af8-9380-1282edca70a1", "sighting--c97e475a-88e4-4aa7-9750-024335bec2d6", "sighting--f9f201d8-b8a7-4eba-9ac1-1869720ba1f5", "sighting--6f7cd025-1292-40d5-b456-7548018f3495", "sighting--01be0dd6-5791-4422-8e0f-60915ec06154", "sighting--416b74c5-3d3d-4ed7-bd4c-872d919c0688", "sighting--31ee81d1-d860-4bd6-85ca-7c0fe1e6535d", "sighting--61ed09ac-ecea-4d59-a855-da4a821310e9", "sighting--801e839a-78a8-4408-ac47-cef71ee2c5a3", "sighting--171f8a7e-447a-487d-bdee-86479f057714", "sighting--c08850dd-c022-4bc3-bbb3-0c25127c6797", "sighting--e0fd5a4b-8df2-4799-9348-9c4b494bc54f", "sighting--ab251870-6a88-4c90-9e05-dfeb7b6c4be1", "sighting--c6706eac-443f-4ad5-8f2b-ab7735571cde", "sighting--d0c484a5-0ab6-4d1b-8181-849aad2db8ae", "sighting--70adeb0f-721d-436c-8b14-6cbb13624589", "sighting--e449d13d-3983-4876-93f2-ad68c8ec45fa", "sighting--47042e0c-72f1-46f1-b898-dd2560d3a39f", "sighting--dc60de8e-77c4-40de-9600-85eb3866b522", "sighting--991e019c-40dc-4988-8da2-8eb7a4646c39", "sighting--a7ccecfd-5924-4776-a7b8-0c533ee0875d", "sighting--b4515fb6-b133-479f-9f94-5baf6df9d255", "sighting--47685223-1725-4f9c-8e9e-0f8b550d95cc", "sighting--7de2a7bd-3d81-43a0-8f6d-c390c8bf517f", "sighting--deaa4e27-8ea4-453b-aa75-69852759a31e", "sighting--0980b20a-7207-4f90-8442-fd4393735dc7", "sighting--d25d1600-69d1-4d29-8b03-44160d0b0ded", "sighting--0d4fd453-8563-4b8b-8857-06c4ff08bb56", "sighting--a24938ea-e232-4db0-bd25-c8cb7fbff2a5", "sighting--c08604e5-b968-4e63-93d2-876427b0513c", "sighting--cf209404-99c7-4f99-9d49-7ec0ec8c172d", "sighting--a7edda4a-859b-4307-bfaf-e2554ed73c13", "sighting--1bf40f9e-cef7-4c90-aba3-c820434d06ef", "sighting--a4fcd8b1-1ed3-4733-9ed8-cf99acefe2bc", "sighting--7b913da5-a4ed-4303-8167-bc4c77270e0d", "sighting--e3fa459f-1c1d-4f7c-a560-af7bb4f5f54a", "sighting--23641258-305f-4573-8bb7-e05e053efe39", "sighting--ea544b4f-6340-47e2-9e5e-4a99eb892a28", "sighting--6b50c2e7-0fb5-40d2-b05e-bb24a6650af0", "sighting--1d8bc722-cb24-4ba9-98d6-919a3cde4159", "sighting--fde8e8c4-b5ee-4ab5-84c4-2a57627de2e2", "sighting--e0c2bac4-e657-4bd2-be5b-4db837c71507", "sighting--18a827b7-7e06-4cdc-b9f4-bfb7e5cd78b0", "sighting--921914de-263a-4c59-a2c3-f125a30c821a", "sighting--31711d1f-3a9a-4c70-839b-e49ff496f57c", "sighting--83959660-9f07-4dc4-86f0-fa9275937d63", "sighting--5d416464-21f3-45b9-b5b9-1a8c716d2817", "sighting--7e8faadf-9110-4dc9-95e6-70d97c8839ed", "sighting--3e3cebac-47de-483d-916d-66d722bc00b0", "sighting--a2a274fd-38c1-4bbd-aa43-9848ae8a35ab", "sighting--0f96d9d3-3478-46da-b467-4c30b4b7fa9e", "sighting--15aacfaa-d97d-4e30-9465-d5786db164f5", "sighting--87f7e64a-59ca-4518-969b-a2a9e84ec5fb", "sighting--edb56bd6-872e-46bf-9713-5fbe1d6a1481", "sighting--a7d11bef-17a5-4853-90f8-cf79cf453fbb", "sighting--b2b145d7-d2cd-42d2-9c05-e8972e30da18", "sighting--37968878-c956-4e6e-b72d-72fcba956b1a", "sighting--7bf0dd26-3fe7-4da8-bafa-08b1c3fed430", "sighting--12687fd8-f525-40d9-a417-34311b1dfb22", "sighting--840d2b8d-cd22-4c91-ad6b-cbb9bd4e992d", "sighting--50119345-e540-4e47-a94a-2b4974294f3a", "sighting--61546999-9e5b-44f9-ba2f-c83ed7b053d5", "sighting--56ea99aa-ddea-4f72-ac33-e70247c489b2", "sighting--09c43867-9b8e-482b-bda0-f6f01b9d4450", "sighting--75719de4-fa12-4fad-a0fa-1cf1dae402fe", "sighting--a61e5c11-6e8d-42fb-8a94-633b11f887c2", "sighting--5380a1ca-6202-4c59-9119-e662d358e12d", "sighting--2d8a68a1-ace8-4d94-aed0-27ac42a58a1b", "sighting--f256186e-a6a3-447d-9f6e-d9a6075c3bca", "sighting--11fb0402-81ff-4bb7-b9fb-cc9185756e55", "sighting--7ec62a8e-048e-48d8-9073-5a5764e181f7", "sighting--fb358ed0-46bd-4fca-8ad7-5fb2230f1e68", "sighting--2cb27b32-2587-48ac-acb1-67a0419c5372", "sighting--607b213f-7d69-481c-894e-b713fbd1b189", "sighting--1c3230ce-e818-4a69-8957-f5ba88fa88a4", "sighting--8ca63240-caf3-4f0b-8af3-1b7a0674cb75", "sighting--679bed1b-2b4d-49d5-a1b8-1d88d21bcee1", "sighting--4090aa5c-e367-4f53-80fb-36502d46e790", "sighting--9547adbe-5433-43bb-b504-9e25081c2b4b", "sighting--18d7426d-a921-4df5-96f2-ef4bfd3a4b05", "sighting--1760b371-bd57-40d7-8e96-afe3f66028ff", "sighting--a30e2567-e8b7-4ce6-9fed-8ebffef9c097", "sighting--abcdd7f2-23b9-4360-818a-de14d1cd0e33", "sighting--1440a5c5-a80a-4f31-994c-a1453442d707", "sighting--3ad3c8e7-7878-4038-a888-79b15706d368", "sighting--7678aad3-8754-4783-9f30-c19e736f8fa8", "sighting--2fbe3cb3-0a3b-472a-a9ff-0d8abc28dcf2", "sighting--bcc2a4d8-4895-4338-bf58-2443d1afbc5c", "sighting--f1623f68-04e8-4622-be16-248959dc70b2", "sighting--855fca53-b609-4a51-ae4d-11516f9e03eb", "sighting--abefa0f4-3b42-4441-8945-b6c5010090d3", "sighting--b0f4952a-4a54-4123-9a4d-232de03912ef", "sighting--cd251673-f152-4180-9111-7b3992505b23", "sighting--3f025bfd-0291-4e8f-bdc4-d35d58201057", "sighting--375a68a5-4cee-46e0-9080-5a8a255ca853", "sighting--43d3318a-146f-4da3-b3a8-118de23cdec0", "sighting--ea5a56a8-dcd0-434a-8f9b-8b873a138d18", "sighting--3320c907-ab98-411d-a175-3a0232787ca0", "sighting--cc262e61-fa49-486c-96fe-180e1331b3bb", "sighting--519d9152-af3c-489b-b29c-239962ecbbec", "sighting--2f5f5766-6921-4e54-bd09-8d4265cfa849", "sighting--f7c80992-8f7c-4c6f-ae08-494cf1d7af0e", "sighting--5d42976e-cc68-4397-abbf-e8dac2b10aaf", "sighting--fd53e765-a108-49cd-834d-4d2b63f85d30", "sighting--c0241f49-0a4d-4cdb-8ac1-323bad105601", "sighting--664b34f8-3846-4bcc-bfc0-60a47b196ff7", "sighting--f4bb4b86-a630-469f-acdd-2834db73cb40", "sighting--aadbcf61-c36c-4f07-b613-0d66365d7fd9", "sighting--f4ae1413-3105-42a2-a83a-1cd15d28be03", "sighting--6b0f331a-3448-4b8b-9a6c-109a79331029", "sighting--25149a25-17b8-4dfa-90dc-463fba8b821e", "sighting--6d066bc7-ee85-4a74-982e-f81eb91d332a", "sighting--9c4b85f4-85f6-4032-a67f-858b7f56b585", "sighting--470328f9-df1f-4db0-8715-9c92d78a4fc9", "sighting--c62b4319-b4f4-47fd-8c5f-fc61448c20f8", "sighting--ca6b6cc0-b5e7-49b0-87fa-4d0a57b0b447", "sighting--8bf06aff-da90-486d-b391-87a4e96c3d2c", "sighting--36bc4e61-abb0-492d-b1a7-3bd0ec8ff316", "sighting--768615ef-542a-4c46-9c38-1cba121cbb99", "sighting--48fcf68e-2ada-4a4d-8b2e-3801573f02f7", "sighting--3dd63f01-43d6-4355-afc3-81f665746a4a", "sighting--ef776c5e-3c7a-4f2c-b22a-c68700d3fe98", "sighting--75a823ed-c409-434c-9ebe-d69340fbd5b1", "sighting--ff9645eb-9440-458a-abd8-01d5bf47d1da", "sighting--b818ac4e-7311-49c7-ae66-8aa33a67f4b2", "sighting--380d44d1-dcbc-45a0-9ee9-aafbd7b4fdc4", "sighting--5a273c79-54c4-4ffa-aecc-9a33712867fe", "sighting--ab891359-2ff1-4bbe-901c-05c7ce59e6fd", "sighting--99ac7f19-3e59-4229-92c6-473dcbf1125d", "sighting--975f9be7-aa04-4c14-8d47-a34f2514c16d", "sighting--ee532c75-8777-424c-8b54-2a9102a4565f", "sighting--d213b45e-e3ce-4a1b-8878-20641dda4237", "sighting--bc704474-2f6b-4a1f-9d7f-01bb6e98384d", "sighting--333d7fa6-9e3b-4c24-ae88-410f34236e34", "sighting--b6cfd413-ffb6-4e4b-b8b3-ff158586229d", "sighting--92db125b-3230-427c-b6c7-7c4f6a65ddf3", "sighting--cfd6a8fd-92fe-4ec9-b4b8-2db99ba8d604", "sighting--f3a087bc-bf7a-4cd3-9265-781807c70c1b", "sighting--963a16f2-9b04-40dc-ab50-393eefa653f2", "sighting--6b4d364b-eae2-491a-80a7-ce06fe09002a", "sighting--e811752e-80bd-4b93-969d-13d7abfafe4b", "sighting--5231721e-4d7f-4b79-a0bc-f9de3560420d", "sighting--b7115ab5-f4df-4801-a642-611baf549cde", "sighting--0ec01c74-d422-40f2-b221-0bb7011edfdb", "sighting--10280382-a4c3-4edc-a97b-b5b728def891", "sighting--59da9aa4-0e9c-4ab7-b9d5-5a2bbb6cebbb", "sighting--0094d587-b490-4785-a9a6-57dd00ed4d00", "sighting--b4d2a1ae-1a88-43fe-bcd3-b060aa1d8d4c", "sighting--09a5e4bd-ae40-4e9b-a50d-8758d410fb0d", "sighting--0774b74f-3040-42c7-a51b-667a20041dbb", "sighting--9d9b95ec-46b2-4547-b756-8a85e2c13ca5", "sighting--3d8ecf27-f0f3-4dd3-a9be-3e2f25ff6532", "sighting--93424429-2a93-4c92-9d81-059283e154d1", "sighting--460b42b1-7ba6-40b9-af28-252c63bad05e", "sighting--8f0ffceb-d2e0-4422-b224-172523718a38", "sighting--88f8adf7-3b89-4b8b-88c9-fcd5ee3affa8", "sighting--369b88c2-9c20-447e-a3ce-137f1e9bf170", "sighting--667b0a9c-f2df-46fe-b821-1190845e5110", "sighting--c9ab429e-7263-4cc3-be02-fc7ce0733fc0", "sighting--bcfe4532-aabb-484d-8942-00d978a1e31b", "sighting--cd4b0b8a-0789-45fa-a239-2207e52b0e36", "sighting--2c6399ba-0ebe-40bf-83fb-a7cd8b9e6ba2", "sighting--cfafd25b-befd-419b-b872-84139544c0b8", "sighting--69ab0a01-e840-40a5-940a-6cfd940d69a8", "sighting--d53e8b34-2a4c-4304-b935-b2011b1808f5", "sighting--42fa3ca0-73b3-4600-b44d-16b65980be79", "sighting--c710fefb-da12-4a42-a4d0-47bf639f7734", "sighting--d273db5b-5dcb-40d2-8689-6b511294daf6", "sighting--cfd348ee-387c-4eee-a591-993290b5abdc", "sighting--b40df4da-8d98-498b-8ec8-fe737ee546b9", "sighting--dfad0070-8069-4d93-a832-8e75e761aeaf", "sighting--82cc0100-0f7e-4ce6-8d94-00d109d20129", "sighting--491736f6-55ed-4ba3-9d4a-1f0ee2ab2e03", "sighting--3acf9cef-2269-4324-8998-22ef771fdb67", "sighting--655b6344-2219-4559-b324-c6bb18695f5a", "sighting--a42362d3-3828-4a6a-88e1-7ae805c1cd9a", "sighting--c48fb81e-f7fb-407b-9268-32abb657fabf", "sighting--5c646c03-7e7f-4119-8ad1-c5e251865c18", "sighting--fd138710-6ca4-471d-b4f2-ccd7f69919a0", "sighting--808e6ab6-3fcd-4031-9254-ec1b08e345f3", "sighting--e8123c25-03f1-4d0d-a944-bf8b13c6d1be", "sighting--1f6a0a87-442b-4678-8b72-2c4beb2eb985", "sighting--f5c6fbad-597b-4340-86ab-15bafe07b449", "sighting--1b94e3aa-5c9d-439d-bbf7-aa40d97837f4", "sighting--1c7043f2-a37d-4730-a85c-6bf4069fb203", "sighting--9a650ee5-7c6f-40fa-9f3d-1e71b5193405", "sighting--e5f2979f-4ad2-4e57-975e-177f5d81d69e", "sighting--481e3fef-b646-48bb-b03a-7b008ec4a3a7", "sighting--0a553ac6-7791-4371-8f4a-ef5fb93e08b5", "sighting--c45f932b-c33b-4707-aa29-5798ff50eb1f", "sighting--eca23dd6-8fac-46c8-8d98-ee97e722520a", "sighting--7d717dc1-3cfb-46db-8c04-2fd811505fbe", "sighting--edd544d7-584c-4863-b0c4-35ee77ceab5d", "sighting--9236233e-4c63-40d1-9eff-ff783f25f750", "sighting--034d5c99-e4f2-46c7-9b11-ec3ca225afd2", "sighting--a4d8721a-5829-47c2-bb2e-edef152ca41f", "sighting--d24c950a-aa8e-46c7-84f1-f90c1ed9ce30", "sighting--083e604c-0256-4728-9c27-d390ff7f4ff4", "sighting--70398924-a900-4b8d-a1e8-2a69cb8aa2ce", "sighting--860ef47a-bd74-4627-8841-bb03725e5af0", "sighting--a1f963f4-8da4-4170-b2e2-f6680d4b666b", "sighting--bdf74c73-4d3f-4396-99fe-c679a3ba084b", "sighting--8ef7456d-94c5-422a-9c25-4c6f4e09f468", "sighting--010f6946-fc38-48df-a4a4-f270fd118d25", "sighting--a1b5d31f-0f6e-4f19-8b1b-750747712285", "sighting--7f054f94-d22b-4859-82ad-3187a224d08d", "sighting--7dfb862f-7593-4c46-9284-505dce39f95f", "sighting--8fa0b55c-de82-4913-9ead-5f3a2033fb52", "sighting--c606754e-e5ac-4766-9f26-047b2ad22952", "sighting--39198d2f-2822-4e6c-ae90-0861b5f9d922", "sighting--99573b2e-6a3a-42d7-9df0-436589362f09", "sighting--41e40161-fc66-4e9a-894d-f68761987b2b", "sighting--3909a099-0e6b-41dc-956b-3085d9a4afa8", "sighting--0a62e156-3c47-4723-afda-532004e04e3a", "sighting--8f9dfb0a-1ba7-4658-bb86-3309d510b737", "sighting--f67a2bbc-4a10-4250-a131-f1dc041c9ab4", "sighting--700329ce-3acf-4846-9c76-7e6e0a123f6b", "sighting--fe625a55-2119-4fb4-8f0d-286ffa944188", "sighting--3c0241a7-3047-4b2f-bf0a-340df1355217", "sighting--90f4f8f1-70a1-4a6e-aad0-dc0c8568ed60", "sighting--7068e751-fe8a-4980-866a-dd7d6d90c9e5", "sighting--231f968c-1074-4856-ad64-071e10532e03", "sighting--f9822c1b-1b16-41f4-b16b-a6817118192c", "sighting--38d08a65-8d4b-4fe7-9dcf-74ecd577f0b8", "sighting--7d1436f0-9957-46c1-b71d-073e534f5a61", "sighting--080d1ae1-2ded-4280-882f-3d2d2fdf330b", "sighting--14b74722-8c4a-417a-a937-4b127b48a88a", "sighting--a05733b8-b125-4380-aa93-21693136775e", "sighting--c05a05fe-30d9-44f0-a1f1-b281c5ea9626", "sighting--0ab346f4-dbfb-4869-931d-437ae29b5ca5", "sighting--bc4d3561-0598-4401-b43c-e913eda764c3", "sighting--0b18d57e-78fd-4df1-8d69-53e8b941af3e", "sighting--a30094e6-7e13-4a7b-82c8-766f58a1897e", "sighting--2d58a850-b8d9-4b87-ad5e-a8a2416666ac", "sighting--44f5b403-7c0f-403b-9756-20d54c923b95", "sighting--28838987-a45b-4cb0-9808-48f16c08f9fb", "sighting--beaec4fa-3083-4e5d-8bd2-1541a8e3c9f2", "sighting--2d05207b-cf84-42f0-b299-4d769d238eb3", "sighting--8d014533-9c0f-4719-bbf7-7ac00f3b04ab", "sighting--7dbcdfc4-51fa-44b0-9a8f-c187592bc994", "sighting--59ca08ba-3bbc-44cb-9d85-c98b4bcc8d66", "sighting--ab630eff-1f00-4f2d-a16d-7f71011b35cd", "sighting--f24d6d77-5dc8-4bc3-82fe-945a38eb019e", "sighting--4a048b4c-4a04-4c9e-95b7-ba2b9e36504e", "sighting--a0ed2ee0-eeb0-45be-b2c0-aa320aed3c2a", "sighting--914032a5-34a8-40e0-a015-a3d21c0643d6", "sighting--6f632d0d-96bd-405f-abc0-04feb33f4a38", "sighting--bf09821a-9f9e-4e69-8b6b-a1461a049cfc", "sighting--c1c89ef7-1e3c-4e9f-af78-0126faff983b", "sighting--4422e90e-b1e3-4713-9f79-bb9008f48b34", "sighting--7a28fbaf-1f15-4b97-9235-a62cd1c878fa", "sighting--02c487b4-6374-43ae-baf9-207b5cb06b21", "sighting--dbdb5c61-086e-4632-8556-9e9b05bc6b66", "sighting--c3352bbe-279b-4781-9e88-e728b7807651", "sighting--2125f26b-cf20-4ef6-b2d1-c7838907a4a0", "sighting--0ef4bb09-b898-4694-8f44-87b375fe3ec3", "sighting--cac4d10c-d3e3-440a-9b62-b5552cce20ec", "sighting--f3937595-e86f-4e20-bf83-0fffcac8134f", "sighting--0b1872f0-0f2b-4539-9cf9-c32c661d2e2f", "sighting--605583b9-5caf-4ea2-846e-947b1f6307a4", "sighting--6b9b0d3c-c015-481e-9cb7-0779ee5fb0ce", "sighting--f407e033-2a48-4679-bfaf-fc7ef8c65015", "sighting--65ae8601-24f4-411c-ad15-e37bdb0ddeed", "sighting--195e9290-04e0-49ff-965a-7fbc6ffb3adc", "sighting--a8bd1aaf-6c53-4f67-aea0-7e51c769d55b", "sighting--d98fbab4-7921-402b-82e9-db9655c65453", "sighting--dfef4b50-186a-4e25-9dbd-8a783d08014b", "sighting--4751db97-5f40-4560-8ba5-a51239ec6cdb", "sighting--687fcf2a-f100-4794-8cad-c0c0f98837f6", "sighting--c0d1955e-6765-4fea-86eb-931488867d97", "sighting--11e0f69d-6469-421f-81b2-ad1975509c04", "sighting--d518c347-f4a4-418e-8d9c-bc9600ff6ac9", "sighting--4ca42936-e046-480f-a0f1-0f02bf6ac756", "sighting--e1cf3d62-9c3a-4916-afa5-481b014c52e8", "sighting--01c531aa-aa58-4c47-bb49-32551a1e3bb9", "sighting--13cdfd7b-10b2-469f-83d5-25349201973b", "sighting--816d6da7-6470-4fb4-9feb-333aa260fc5d", "sighting--6aed9387-87ef-440d-a3cf-ffffd5aa2614", "sighting--e44d6477-82ea-456b-82e3-001018affd51", "sighting--c1d85aaa-03e8-4d4d-8e5b-ea730fc805d5", "sighting--ba3d3dd6-c134-4da7-b69d-3f2c019f920e", "sighting--94c8ab11-5396-4395-bd02-76c7ad9b12e3", "sighting--9b7704c8-4ea6-4ad2-b3d6-bb798c0b6f20", "sighting--4b2a3b3e-134d-4346-a58f-166af28871a3", "sighting--04cfec1c-8109-4679-90b0-2bb128250797", "sighting--a042834b-bd5e-496d-a731-daf950ef1219", "sighting--0707ef14-b896-4694-8e12-724916e90388", "sighting--691cc0f1-68ff-4aae-b9f1-9589eaae26fd", "sighting--a7ebfc0f-1c3d-4241-b5f1-4ad68ea02f3d", "sighting--401d5ea8-19ac-4d34-a988-8eb2ac7ca94f", "sighting--deea2dca-8aee-404c-a95e-940f7de603df", "sighting--6afa638a-495c-4550-8efc-4551a2e82493", "sighting--da686737-2581-4584-8c9a-d9c082973ce3", "sighting--d5d2fe1c-8cef-4af7-a7ec-0ce5ed42246c", "sighting--b0470811-b701-43d6-928b-31ad600c389b", "sighting--509e232d-b002-4386-ac53-f496c6a1cb6d", "sighting--2c67a212-637d-4960-ab1e-18e4aa09d4dd", "sighting--35eb750e-a062-48b3-b3a2-35af238ae6c2", "sighting--4f1b858b-37ee-4b3e-b610-22058ab50ceb", "sighting--7221874b-2813-4e72-b52d-640904fce799", "sighting--78bcabf2-b448-4d90-9b3b-f7ba25283efe", "sighting--23be5168-d5e5-47ad-8228-a056cad56c64", "sighting--a6562a98-cf26-4286-9548-1e22dd9a84d6", "sighting--67b44cbf-fd0c-43b0-8bf7-f80eace0f21e", "sighting--46f2d3f4-c330-44aa-b589-23740579f082", "sighting--6439ca14-56b3-46eb-835f-16ccb7cbd35f", "sighting--252d08bf-5a06-4d7e-8e96-0f4ad6a2e64a", "sighting--73be71df-e68d-44e5-ab56-d69308346415", "sighting--be442e0d-08ff-42db-885e-ec29858b8df4", "sighting--e7b490b0-9c15-4b03-914e-e1ab857a6fcd", "sighting--41c6f2c7-0c65-4745-9e3a-980c27590e54", "sighting--a1e61cc2-c0e4-4b18-9a1d-8ef910e56be7", "sighting--adb820ff-c979-47e0-8ffe-8406ba517e2a", "sighting--8540a613-18e9-4f66-b8dd-794d5dfe7210", "sighting--fe2c0c8b-d4fb-46e9-9dea-b887808317cb", "sighting--d8c38b5b-b3d6-4cd0-ae2a-e89c1063faff", "sighting--33434159-320d-42a8-9ff2-e9a1811053be", "sighting--a718a7ff-09f4-4e07-87b9-71ecc2b19ce7", "sighting--7432e35f-feb7-4f51-b5ee-d49838912130", "sighting--4bfe10fd-6b30-450c-8fb2-e72bfb484c17", "sighting--76cc030f-1f26-4f28-96a3-549e0b36d32c", "sighting--5691bf7b-421e-4d66-ad5a-4f3299e863e3", "sighting--d68ec36f-c5e1-4d3b-be17-a1e3ae5bf829", "sighting--8f65d06b-d6b8-479d-a127-52b48b1645e6", "sighting--7c9f669c-c2c7-498a-96b1-05415863ced7", "sighting--1dd3e879-3978-4b7b-b32b-98cddb3f5b57", "sighting--fdd77284-4a96-4501-b85b-ff5f9c6de391", "sighting--9eb39c63-992d-4f57-a3cf-344ac0fdbf41", "sighting--0a085957-c880-43fd-9827-91afa0a4e6d7", "sighting--7532a16a-fe48-40c6-83a7-3b1dd76f90f9", "sighting--dcb46cf8-82a1-497d-940d-f893863f2728", "sighting--cc9ae3cd-05cf-4797-a28b-00d0386f076f", "sighting--079fa15b-4451-4c12-bf66-5696d06ef3ca", "sighting--d65171ea-ddfb-4db1-a16b-bd2889a9a103", "sighting--82fc6bf0-74f6-498a-9688-3ba084ebcef3", "sighting--b952cae1-0fe5-4f1a-9feb-9c5af78fa367", "sighting--039a898e-32cb-4fec-9ce8-39c46d62c881", "sighting--278b9e35-eb0f-45e7-9a0b-d78b31d8ad2f", "sighting--be26ef29-ab51-498a-82a8-95a8447d6f70", "sighting--05ecb5c4-f643-4067-98bb-f09d6ea74452", "sighting--4ddad0bc-220e-4798-8164-17598858d23a", "sighting--8a696142-5b4a-4c7f-a1fd-10c4734f4e4d", "sighting--69409096-9d49-43f1-8e95-6742c76233b4", "sighting--98e9b98c-3213-4931-bd82-fb1a46fd5e0d", "sighting--2c0ec428-3163-40ac-83df-0f0d97013d47", "sighting--77d6afa3-0d74-47ea-b123-794bb5ef69a2", "sighting--cc966367-f421-4ff2-a769-885bb399df9f", "sighting--92b0e314-e131-49df-bcfc-30eba44af158", "sighting--9449c778-6e4a-4e64-bc3b-5419c13a32ed", "sighting--8758b945-1a51-48e5-b0ec-8c5b2dcaaa97", "sighting--8a7de54c-530b-4180-b551-c8947ca4aaf8", "sighting--b6f4d5f8-7a76-4f9e-8650-6287cad68d1d", "sighting--d3196397-9bc2-42f2-98c1-5aa318eb789a", "sighting--fd585222-4d8a-4df3-9feb-5905b014f633", "sighting--f704de43-70ff-4ef1-9732-b63c61bfe3d6", "sighting--b65e2466-300a-4582-a5cb-2a7a1d91edd9", "sighting--15b57ecc-3e75-41ac-8323-9548f86008b3", "sighting--dc51281d-9bb9-4fdb-8cc9-a23827229a3a", "sighting--df401ec0-9220-4e13-8031-08a1b7818d4a", "sighting--fa422ebb-2b64-4112-86a4-74ccf35094f3", "sighting--eb59f91f-8c4e-4945-bc65-1fec902079b0", "sighting--5187821a-7c8f-47ce-a34d-9d8b6eb31970", "sighting--66953c8f-e7bd-4f5c-9c24-c6928528057d", "sighting--8212f541-7a16-4797-871c-f8d63e4835e7", "sighting--fcd1edbd-a69b-418f-870f-93fcd2712119", "sighting--9817bcc1-bf6d-45d4-ad6c-f213fc6a314b", "sighting--022d05c7-79cd-41c3-87b8-6ff8f9eb19d0", "sighting--1946ecb3-e0f2-424c-87aa-cad27dd4e282", "sighting--e83979bd-19bd-4759-9e12-c16ce13dbb8f", "sighting--7cfea259-2a7a-4dbc-b1f0-ea19a0d41595", "sighting--478ad342-074e-4839-a5d6-0d9b2e7282e7", "sighting--b4520513-5622-4023-849e-eb876acc2ad4", "sighting--85fa22fd-84fe-4633-91aa-b9f4ce1bad59", "sighting--163fa083-539d-4fb0-9296-31c69604f6bd", "sighting--29095233-2cec-44a1-94b2-3566f7443517", "sighting--eb477d0b-2734-43de-8e52-e497805c6424", "sighting--d0add2a0-9ee5-4846-9cc2-d766b1338eb2", "sighting--548ed4b7-5446-4b0e-a140-caa1198ae9bb", "sighting--fb284633-486b-4bde-a356-32052c040ad1", "sighting--a79d171d-ec08-49d1-adf2-ae78a60bdaf1", "sighting--f22c8def-a9b4-41c5-bddf-54ad4632f1cb", "sighting--e58a1bf3-1662-4786-bbb1-3f26f3a004ce", "sighting--67d45123-b708-41e6-ad58-222de190c125", "sighting--2ebd46bb-806b-4165-b1ce-79be3de0a4f4", "sighting--0aeb88e5-de1c-4771-90a5-04d329d223d9", "sighting--1dee7d5d-c954-44d6-afc9-0c0d491df686", "sighting--6f417c7b-b69d-40b2-a19c-e9e97a220b35", "sighting--16ba0441-a902-4275-9a29-c869c84f8493", "sighting--118eee36-47a2-4f4c-9794-cd0d73b54920", "sighting--04f8ed3b-c625-4b0a-867c-ece014a4eac1", "sighting--d8dfd672-b697-42af-865a-663de96d37ab", "sighting--e2974944-c1ed-4d8a-9984-834805fa41d3", "sighting--71084fbe-cb20-4615-9da9-06c13da5603c", "sighting--01d8123a-5c03-48c8-aea8-096960ef9279", "sighting--a59009ed-e9d9-4796-9860-074303ab832c", "sighting--86ff5a27-617d-43b7-814b-2466ff23e6fa", "sighting--27783cc4-dfa1-4b7a-b796-fca932613a58", "sighting--7df6e169-085a-4e24-b971-5735a14cff3d", "sighting--13e6df80-8ef2-44b9-b2d2-c671e670ebf9", "sighting--ef9b09c8-a372-4a3e-85ce-86008b9d5bab", "sighting--9ea2b561-d805-4f27-952d-519b14ed0ca9", "sighting--fe94abef-69b8-463b-9519-dfab280df852", "sighting--e76335a7-3e04-4d87-a238-2f637c28fe23", "sighting--4deaec07-f38f-44ca-9fd3-c25c9ab6113b", "sighting--c8ca5cb7-42fd-42db-b13f-28a636b9d808", "sighting--6f20dd52-19b6-4bc8-aceb-bccb1d4fcdad", "sighting--aa6f4da9-32b6-4b2e-a45b-94890d47dcc1", "sighting--3cfa1d35-1895-46c8-85d7-5bb872278512", "sighting--c2bd614d-bae5-4ea6-940e-d821544c6b1b", "sighting--5527b38c-e7d8-4645-91b0-516845df3005", "sighting--12bc1680-7cda-4346-92ab-8e99ae4f4a91", "sighting--f80627fd-9560-4ed2-a043-6b75d69f775f", "sighting--67ba2ba4-3ecb-420b-973b-5ee80114c0c3", "sighting--5148c7dc-b4a1-49a4-b089-ef44d0d69e2e", "sighting--8efc0776-80c3-4a13-afd1-628136c77bfa", "sighting--1baf64bc-1c93-4512-90a4-defbeb436594", "sighting--eadd375d-cb45-4e36-9a95-56fbf063e34e", "sighting--5bb13de6-02e5-417b-afad-9893acbeb804", "sighting--146995f6-dc56-4d18-958f-3c3729ae4df7", "sighting--2d49e9fa-a08a-4923-9f7f-4cbd5e5820e1", "sighting--2efaa25b-3cdf-457f-ad64-a8afa7a5f9a5", "sighting--b3914b22-4bdb-472a-ac20-5e16dc61091a", "sighting--86833125-788d-48ec-a8a4-78eaa96450d5", "sighting--1f483286-5166-4909-b17c-225b4508a37e", "sighting--52a0e121-432a-4dbc-8c30-f585ae84933c", "sighting--30c237c1-a122-437a-a343-b96134d96484", "sighting--0348c56d-3a3c-43b2-96a8-d5dc8b8e971a", "sighting--d7607e18-3b52-47e0-aa4f-7775e7cfe351", "sighting--c4ab4167-83d5-47eb-aa17-decd2a58b0f2", "sighting--f14bd147-c2d7-458d-8431-dcb7278d5314", "sighting--1952dfc0-b86e-4456-a4b1-ce8aaef28418", "sighting--858854df-f925-47f8-a7c3-3fd68003a0f6", "sighting--8449e1e1-91fa-4776-a2a6-e18c41857401", "sighting--c77b633a-a8b9-4392-9d61-bdc1fda1601e", "sighting--dea7def3-772b-4868-bcbf-efa02ea060d6", "sighting--fc04c450-8ee9-4300-b88e-ab53c390a8bc", "sighting--bb0f9c64-5b8f-41c3-a56a-bf6dd30f1128", "sighting--0a005d6f-70a6-48cd-863f-8225367e7703", "sighting--8e4b5cac-72fc-4319-b2bf-d84304035fcc", "sighting--572da80b-d2f0-4d98-bb1c-fa30372dd04c", "sighting--a0fdf797-106a-46db-baff-702060f64fbd", "sighting--c2abbe61-b4a0-4837-ae21-19ce793db6da", "sighting--7370bd27-ae65-4d5b-909a-aa759f5f65ef", "sighting--4c4f0bdf-d855-4223-aa82-b028f3a07bf5", "sighting--f30c980d-f876-4fa4-9b1a-1062fcd30ce1", "sighting--2018f2ac-d72e-421a-a8e9-2babff82bdca", "sighting--30251130-8bcc-4db9-887e-8a9b7c73eb50", "sighting--020e9a42-46ca-4c18-a89e-4e1c12e9d074", "sighting--b5afd81d-f000-4bf9-a9e9-87e247fdfe79", "sighting--f42d57bd-b5ed-47ed-a70f-9f15f9b3d6be", "sighting--67d2e9e5-6370-4577-85c4-09b8a450ce37", "sighting--574eabc3-c8de-4db7-acff-0f73a20c324f", "sighting--c3b2b20d-5bfc-4926-ba7b-418d966a2f08", "sighting--6f9cde68-1bd3-4235-ba0b-21af2a44eef2", "sighting--86609db0-fad7-4952-b6d7-b2c9b57bb45b", "sighting--716e8eae-362b-477a-babb-3977eb7c3a90", "sighting--f1d579ef-e4d3-421f-953d-b70cadbe4fed", "sighting--6b69b6e8-d4d4-4ecf-af46-2b0403228e08", "sighting--64a034b8-b79f-4531-be19-52923f8d423f", "sighting--21b6323b-e5d4-4884-b475-c45e6def4aad", "sighting--58c8044f-f1c3-48c1-805b-aecf1d24243f", "sighting--5ae41ed4-6e65-43f6-b863-dcddaa374d10", "sighting--70084c5b-49b8-44a5-b706-a22fa8ee5992", "sighting--b1598c15-19a3-4503-8586-e5cad6a64e60", "sighting--7190f269-9ef8-454d-a59c-40926a405efd", "sighting--4ab707aa-ea7f-4646-8f06-8d8b44fe10b8", "sighting--b60413df-9889-4271-93e6-d8116845016e", "sighting--e234f27c-0b9e-49d1-9b32-3035b19f9a48", "sighting--7ea1b594-1663-45dc-a516-fef5af639195", "sighting--aaa61ba6-f354-42d7-82a7-befe8b56cade", "sighting--dabcdd7d-4e3b-49b4-85e2-846161451d26", "sighting--30a6c5ba-51d6-41c1-827f-9a25c1d06103", "sighting--edf1a3f9-854a-45e0-b348-693afef2d93d", "sighting--6866a5dc-7569-4824-88fb-f94f67fcd140", "sighting--07c0de33-7b4f-49ac-b797-5350f271baa8", "sighting--d0e70eba-91e8-4428-a771-20ba6a923391", "sighting--eaf750ff-021c-4f51-be15-52f3bb4d3137", "sighting--7aaa5cb4-beb6-4767-b7e5-6f25de4bd1d9", "sighting--86515003-a686-41f1-89b9-34fd5d233321", "sighting--4799da9f-0b21-4ee1-9607-ead5944221eb", "sighting--55d48afe-973a-4889-b04f-b841879fdfb5", "sighting--88913a5e-6a0a-41ac-8c3f-d6e09e325de4", "sighting--6621677f-1e78-438b-9e59-6f904b737357", "sighting--0070d6b7-33bf-4458-b5a2-427c5dbac1b0", "sighting--9865e32f-6667-4bc8-9a62-c4e4dee97e83", "sighting--1675a175-98b9-4596-ab68-fb0822fe396a", "sighting--e86bba30-2952-41fd-b5ee-1d104fc4e40b", "sighting--3733d3d6-1582-4ef5-846c-744c434a3a99", "sighting--599c499a-5d6f-4d2f-a4c8-8f4990d2a5ff", "sighting--4ac851c5-7d68-4b85-9d27-444268478644", "sighting--5d53faaa-4819-4082-b9b1-6ea335b52842", "sighting--957adb03-36ca-432b-ae46-bc5155f9abc5", "sighting--8448db14-e3cc-4b7e-b404-a4ddd7617f45", "sighting--5053a983-5143-4809-bae8-a846f0909eb7", "sighting--49c25a2e-f13a-426f-b1b9-cefa0f0fe400", "sighting--f001a0c6-a629-460d-afa0-3e59bf341519", "sighting--c8d885fd-0518-4f85-9324-e19c52bb7e0c", "sighting--1cb24a57-6898-497f-a600-1e7de7f081e0", "sighting--d382edb7-9869-4e09-adae-301c6e90b959", "sighting--04b5be44-25b4-4a10-b70d-26d9c518e307", "sighting--8fd21714-42ef-4bf9-94cf-ba76eee167ee", "sighting--07d5ddc5-0d97-43d4-bfad-58563d28fbec", "sighting--4852bf10-7ab3-404b-91a4-eea989eaef3c", "sighting--fb81be47-8a75-4239-bb92-05725c70bd10", "sighting--afb8cff5-4b53-4d71-97b6-3e5392e936f3", "sighting--bba048e3-1185-4720-a553-cc889e0bacdd", "sighting--607fae0f-2b2e-4f2e-87bb-dcd31206109e", "sighting--24110068-fb87-422c-b634-c214a2eccd0f", "sighting--d599b3c4-b871-4266-a346-6c997461bebe", "sighting--64ce7d4f-3089-49e1-be5d-16b0a074e014", "sighting--b36b8ee6-cc99-44c5-b301-f00b56bf353f", "sighting--ab4cec0b-0b0a-47e9-bfe3-e569979a6fca", "sighting--2a183378-9dc5-49cf-885f-065f955250de", "sighting--27f418a4-6875-491b-815d-7cc9dfc9f707", "sighting--7183a263-403b-494a-940c-42d0bf8248cc", "sighting--44f766df-4fd6-45df-a9a1-fd92633dcedf", "sighting--31a5f799-1716-4480-93cc-f19041d091bf", "sighting--4beba207-f248-4874-809d-46dde77508d1", "sighting--6b04ae54-4d49-48a6-b9b7-75b377dbb53c", "sighting--45905710-9114-4de7-bb17-3171ff6fa87a", "sighting--7599a765-28b8-476b-a55c-bb7cc79e9a4a", "sighting--1438cf50-a6e8-4b94-99e1-cbf646a26a17", "sighting--855275d1-a138-4a2c-8d1b-4337b3a8ecaa", "sighting--b12c59b0-7491-4899-8898-a99d979ac224", "sighting--53b165be-08e6-4072-b817-9ff0bb4ecff9", "sighting--a6a9df68-2642-47e2-9ef3-e7d8d83b1a23", "sighting--761911a2-586d-42d1-bb43-9998e48fb3a8", "sighting--d4f91e4c-b5ca-4570-8676-a0887298c413", "sighting--f137ed3f-a5f3-46de-8e02-016a41210c1a", "sighting--8845742e-0eb7-407c-9609-870f4ec421a2", "sighting--c06fb943-8fca-44b7-a312-08e1a85ef321", "sighting--e354a368-f246-4a7e-958a-65c33e16654e", "sighting--df2e2df8-59f9-4fb0-b259-1df1e94f5340", "sighting--1f6d5b46-4523-4c2d-992a-be25ef7a133e", "sighting--2e124431-5bc8-4d91-82c0-f089f06f33e7", "sighting--6220ad07-2acd-4138-b878-0b09d12c9a65", "sighting--fcd71ddb-0616-462d-880e-95f4b622f3e9", "sighting--cc4faed1-14c3-4ce2-97f3-aea547cfa9f2", "sighting--37f470a1-0ef3-45fd-bb91-76d63aaa5086", "sighting--df37701e-b6b3-4045-83d1-53c07889e3c9", "sighting--6f72f272-6c16-4419-88d8-48605c4447ab", "sighting--da7000bb-1cf7-4a21-a271-8f309ffde206", "sighting--f5deae15-93a8-4c24-b63b-5c2b7eaac740", "sighting--4d9b242b-1e3d-4d9c-b2e7-bccb6803471a", "sighting--f5cd4910-ac0b-4dca-b2b0-6dacca89d8dd", "sighting--8e9f2ca4-dadc-4a7b-b663-b059c7cd5446", "sighting--b0e43b01-fa27-41f7-b10c-3514cb2bcdca", "sighting--02f83327-f8b2-43a1-bd6d-fd09d5a06e00", "sighting--0a35f93b-414c-464d-bb24-f3d740a59ac1", "sighting--db75d921-faeb-4d0b-b3d5-4655c1ceaffd", "sighting--7616c094-b6aa-414b-b795-bd27b28d1c08", "sighting--e6e7561f-76ae-49e4-8d7c-d126fe9f4390", "sighting--37a28c1b-8c29-4397-8534-124689a055f6", "sighting--10de4a27-4f1a-40de-b47a-d40962611ba2", "sighting--fde53ff6-e77c-4c42-b0ea-bd92cbe49c57", "sighting--fb6ec049-94bf-421d-b8bd-e4c0c6ec53e5", "sighting--69ddd3af-6dd7-4bd5-a472-65a444f58100", "sighting--79858ab3-df8c-46be-8e78-fd9e03f18171", "sighting--d9423257-7994-4f6c-a724-248fb9428587", "sighting--a1e94217-9dc3-4e86-be47-e9e1cce0f8f6", "sighting--cfeed412-dc07-4361-b62a-b6ffeec22490", "sighting--070afa78-9db4-4548-baf5-e075d4a82bbd", "sighting--d0a1b596-9f90-451a-af4e-b79c992f617a", "sighting--bfc5f5da-b4d0-4a51-8f39-044fd7395e61", "sighting--29baee3a-950a-4b9c-86b5-2b94c487039c", "sighting--7f4ff5a1-b682-4a8a-9235-0d92605c946b", "sighting--4a3ec3ca-b15a-4946-8138-e2917828f62c", "sighting--1c453b35-40ef-4b00-b4dd-dcb1f5770966", "sighting--3b01d520-516d-486f-bc85-6f0e62eb791a", "sighting--71a6cace-b2f6-4a07-9094-d7d06ac0ccdc", "sighting--f678f228-7e33-43e2-819a-ade2c850923c", "sighting--1bde65d9-59d9-4bc7-a62d-1ca58738b3ed", "sighting--c61b1418-ee4f-456b-8e28-b8fe26c5c294", "sighting--d8181888-681a-49e0-906e-b48a31d338da", "sighting--8c53c387-65ed-4d80-a573-b48ceb6986cc", "sighting--f2bd6412-f96a-4ad2-a0ab-e00a6e060005", "sighting--d7dfeed0-6ae0-4738-9b16-966c2086b6a8", "sighting--6796ccb3-ed4d-4297-99a5-ebbb1179f8ab", "sighting--0df4dbd1-50c5-4484-8623-7debe1e1d20a", "sighting--68bf1d01-453a-4d93-84f8-e1a5e28fcbc3", "sighting--1ce7a448-8804-45cd-a518-fbfcdfdaee71", "sighting--bc9d31ec-fd8b-4ab6-864a-5af153ee1d5e", "sighting--25695870-2d3f-4a8b-8379-cbe865593b21", "sighting--30d1e759-097c-4be7-b0b4-02738875f93e", "sighting--eb78272a-5e67-40db-8e89-c5201a985e19", "sighting--c1f037d8-54fe-43e7-b582-08d796b7f6d2", "sighting--21ad74e4-7db8-4400-a936-266a18ede816", "sighting--73e875a1-80a2-4016-85b2-5e5f024394ef", "sighting--6aaf3ff9-d6de-463c-8ea9-1fa5dd26eed8", "sighting--3675a67f-8409-407c-a78a-ca7f8c5fc5e1", "sighting--3ef53281-34ef-4829-a5b8-6630a51b0dce", "sighting--5a775e50-1bc3-4eaf-abd5-8251242bb031", "sighting--0c902d03-8381-4c7a-8b44-ef8937cb2884", "sighting--fd21e7a5-6c0a-48e5-94dd-5415113f4b98", "sighting--2f43f276-e04e-432c-b21a-5803298d1960", "sighting--dcd4f232-c633-44fe-91ef-8769273f45f0", "sighting--67f7abae-3109-459f-944e-9a254d289f0b", "sighting--970c6447-f227-4c7a-86a4-1c13586c8234", "sighting--40884435-7b37-4513-8f8d-9fd9fe9ff1dc", "sighting--cae905f6-360a-40b3-a149-088299606586", "sighting--bcfd0d46-04f8-4945-adde-e738838612d0", "sighting--986b1938-38d1-419a-a094-ac0ccb3c8bb4", "sighting--7e0a1120-cfe0-455f-b71e-668e7d4e8c09", "sighting--d841ae30-fd65-4642-8db3-33b2cac6c321", "sighting--fafd3055-eb72-4295-96b8-3753863457a1", "sighting--dedda028-19d7-4bf5-9a14-063b068082e9", "sighting--a6473df4-a13a-4f1f-88a9-6dd852df9b5a", "sighting--84e3914e-bb1f-4ee1-b4bc-72a1fb85c080", "sighting--08d408d1-9b24-4bf5-9a3d-ab4e0df2d6d1", "sighting--1e1a6edd-18e7-46a8-a353-b082984c7a16", "sighting--1e649d19-7b0b-4ede-8547-b75833a9f387", "sighting--91800014-7582-466f-ad0a-bd601ee01c8e", "sighting--2c29196e-1024-4f3e-ae26-93083aa077ca", "sighting--98195801-3550-4b9d-8d3c-c1b5ccf57e0d", "sighting--8bc570b5-c8af-404f-b3d5-2daf56f6e26e", "sighting--f1e7a33a-d838-468c-bbad-66a51567f2ec", "sighting--7e0ac474-0854-404d-91da-6656ef2ad086", "sighting--fbb76d2e-1ed1-4d2b-8ad1-4d7dccaa77e4", "sighting--c353ce6d-b7c6-4d95-8383-5f312b0a9ff2", "sighting--cd6eee82-9d79-4358-b0b6-ff7de47e9835", "sighting--ba17d4d0-bc8f-4b99-abbb-a176540df5d6", "sighting--93f3d41a-f9a0-4060-a42b-eea2f13ac189", "sighting--e44f160b-80bb-457b-981b-870ef5987d20", "sighting--51bfdd0c-2722-4501-a4e8-a4f5652c7439", "sighting--3f04b28e-187c-40fd-9599-b13f4ce29cb7", "sighting--9b707523-7dd6-4fd2-83ce-9b37bc91e862", "sighting--a19d3032-b2b3-4f4d-a04b-5a101778451d", "sighting--9147edc0-b033-47ad-b286-84af602bd7ae", "sighting--c37cfdca-29ab-49b2-94ea-636faa017b26", "sighting--c9b7786a-140d-4664-89d8-2fbd264db9ee", "sighting--bf083b6f-c5b5-4b84-bf45-790763a81512", "sighting--dd752362-f477-4544-9ad9-abfa55cdbfb3", "sighting--62bdea5c-005d-4c93-af6d-79d185b17902", "sighting--9558d7d5-c22a-4454-aeba-b9fb2811cbce", "sighting--21e1609b-5538-4cce-b21e-48eddf649d52", "sighting--e093e53b-d6bf-4711-87be-5d63b82bbcec", "sighting--befdf5ce-9e35-453c-86f6-2ee426969ad9", "sighting--b2702fa9-f6c4-491e-83da-86b753b3b60f", "sighting--125fd79a-26d6-439b-bf66-d7be09657faa", "sighting--17fc5611-4188-4b1a-89e5-3f29839635e9", "sighting--391e33f5-b6cb-449d-b975-6693a54484cc", "sighting--8b3f830b-ea2c-43d5-b656-28695fd4a720", "sighting--a3c4d6a9-d04b-4f10-83cd-4dc324257658", "sighting--4dcae9ff-52f0-42e7-baef-9d329ac75bb6", "sighting--7916cac4-e70b-4d37-9cb4-d0b6b9ecd2e1", "sighting--30cc32f1-6c20-489f-b710-d0cb12d817c5", "sighting--90349ddd-8df1-411a-94fc-80f7c1a34927", "sighting--caff0159-e528-47be-bf6f-a8243124301c", "sighting--4f80ef09-8ec5-4314-af0c-b2d636d3fcca", "sighting--463aa21f-8053-4188-8667-0263920ecc84", "sighting--bdcdcc15-88d6-4675-8659-a75bf0a72f3f", "sighting--a1e00fe4-f141-47cf-a6cb-59e77b99357a", "sighting--447f1f13-6240-4d01-8a68-c7b5c68fcd65", "sighting--5995a30e-9716-4449-9226-fe29ee8586b2", "sighting--9ea3c524-45c0-4f95-a039-d83dfbaaf1e4", "sighting--877cd6b9-ceb0-40c0-904d-9059c4b9a1ab", "sighting--6bc7d429-6d2e-4718-a597-0d9017920446", "sighting--56f369b2-a67a-4926-b9ff-75fd1add3760", "sighting--e157069c-29b1-43d0-9f05-e8476d7a310a", "sighting--2e581594-ecb6-412b-a779-5f4c20ea2e1a", "sighting--875fc05a-d644-4661-9a7a-aafdf6b92947", "sighting--2da03b68-e77a-42ba-a2f6-3e71abe7b63b", "sighting--248e9c17-81b8-45c0-932e-08b8ed163947", "sighting--7c3912d8-6fd7-48d1-bf5d-110278068ff4", "sighting--b43459b7-af1c-444c-9edf-c26bd2769f0d", "sighting--170b0333-cfa5-42e5-99f1-a4dcbf078ec4", "sighting--61f758ec-0b95-4572-ae04-bb51eb40cd52", "sighting--c87194e7-cf9e-41f2-be9f-5ba21021c3a5", "sighting--2c3509bd-f205-4b57-8a46-4138c07130da", "sighting--f1a55065-cdee-4dfd-9594-5ff0d47477e2", "sighting--18068c4e-bd06-463b-a265-262f85e9f8e9", "sighting--15311f42-6291-4267-98fe-02becb34b57e", "sighting--696c4453-556a-42b4-9ee2-83be0c7d584c", "sighting--3f350aca-a0ce-4939-9006-07e6ecd6fb3d", "sighting--da4ef27d-59e5-4c67-a6e7-d9366c8e26eb", "sighting--ffdda615-71d4-4d44-b54c-c54c0ac7da0b", "sighting--e745e2b3-0e4a-44d4-a97e-9a55cb0f4ae7", "sighting--f19a3ddf-a6e2-4f67-8541-38d89ab1a38d", "sighting--940abcad-3cd7-4696-8535-b2ac389dcc53", "sighting--5a4962b8-5634-4887-b36b-4fc614b55abd", "sighting--61a3c999-bbc8-4f7b-98b7-413b48997877", "sighting--e2f19d1c-5183-43da-adfb-f8ed15ca5537", "sighting--27b73e5a-513b-4c49-a1a9-732350df94ff", "sighting--41b1c1b3-1fd5-4e3d-9dc8-79db5f3b04cd", "sighting--f6c5f96c-6461-4b8b-9218-5ffe85a6b17b", "sighting--67b7dda2-655d-47c3-8290-e1879bdcf327", "sighting--04dc9a5a-26af-4ffa-a281-ce4d08c76d11", "sighting--02b66a65-9593-4337-9d0b-dc49da6b62a6", "sighting--5780ce23-4973-4eea-b5a7-5df8443cbaf6", "sighting--fd4a7c89-c707-4419-bb65-0660f31b9ca5", "sighting--6022a795-d8bf-4e03-9dcf-08bdb91363a2", "sighting--487e6e03-4501-4efa-81bc-b41e2f7f61e7", "sighting--abc7ca4a-16e4-4d1c-a609-31368ed15ee6", "sighting--fcfaa113-7f54-4e52-93b1-4db6d3970684", "sighting--05043d6c-64eb-4590-aa0c-e33bb003dd39", "sighting--6d07372b-50e8-4901-a690-a2f471b30b97", "sighting--8bc45f45-ce87-4467-8e41-db4dd6bdacca", "sighting--03903a6c-0a11-4f5b-a95f-ee2c7c1d5ed3", "sighting--2f1c6ef6-571e-4b67-9398-0d71b71dfa5b", "sighting--88596f98-1c31-44a1-9165-beb6893346c6", "sighting--78239a89-1f43-4d15-9221-205775267702", "sighting--2085cb27-71fb-43e8-ac0f-80b945b1a36b", "sighting--b3f98bd3-b6d1-4c85-b4fc-46abf7d8efb6", "sighting--8b45a502-00b4-478d-bd12-97234c2c2865", "sighting--d7b93797-e2e7-4b55-9a22-d93ad6c78386", "sighting--c01c1937-7d1e-4097-8061-d94a7a47681b", "sighting--afab23f9-52d0-46d9-9518-9968664c8769", "sighting--cc6f2afe-2a46-46be-9b99-2ca4465f9aa2", "sighting--983a51b3-3d78-4022-9479-f5eb540a90aa", "sighting--6107a7fe-dc6c-4df5-a353-64e843dd42b1", "sighting--cafb0705-6314-4e8c-b7f9-2dc90693e7d8", "sighting--17abdd7f-21bd-499e-bd1a-181548dab3ab", "sighting--b6d056d7-5105-4fa5-966c-858d5681fac5", "sighting--bf0cafb9-4a4d-4f27-b00c-dd185404db94", "sighting--f18f8e47-144b-4a70-8a69-54b72bde613a", "sighting--694b4681-2f4b-40bc-b47a-370e6860cb33", "sighting--be07ee86-221f-4f3a-87cc-2d9e3b007afe", "sighting--ece909cb-67cc-4085-a277-cc919dae3442", "sighting--035cba93-e461-4134-b2c9-028f6ed8bc24", "sighting--1573b179-3ca7-43d4-856e-0b1fb11a4b33", "sighting--27cc4f88-e797-4398-a274-36bb0d6077e8", "sighting--ccfb9ea8-7266-4478-8c5e-906dda6e1485", "sighting--f010ef13-4c5d-494e-ab46-609235c31a59", "sighting--556b8c49-9784-464f-8084-aa6087b555c1", "sighting--02dd4d36-dd67-4af6-a361-31baf31610ae", "sighting--18a81c8d-ff83-4f24-bae2-c1c148e51547", "sighting--a7df8b85-f9e6-4f79-8dd7-956f984614a3", "sighting--7ea8d64d-5d33-4121-80c3-8e9dfd36a8ea", "sighting--6c2cbda4-0d6f-4ea9-9cd5-6feb77aa5d51", "sighting--911f91ad-9240-4884-9027-c73764350073", "sighting--8b75c77a-d37f-493b-b919-32c4e79f9c51", "sighting--e63f83d8-7927-4c1f-b5f5-3087702fd2af", "sighting--5b3e7c58-93d7-42bd-a697-07d8ca889b7a", "sighting--d51e1c66-5dc0-4e92-912b-04e79f9d900a", "sighting--63af2d49-8fee-4d2f-bb7f-a78264ecc2fa", "sighting--506fe628-59c7-4e9d-8dd4-9510f3db7e48", "sighting--d45ec0c0-370c-41b7-b8be-c17a7db61d3e", "sighting--50645963-f4a4-4209-8bc4-24c50c685d2e", "sighting--b4720853-ef1b-4bd3-bde6-1ac15067aca6", "sighting--fc4f00e7-4b49-411c-b3fe-3eb5e7915ffb", "sighting--95265b49-62cb-4259-afab-e96e2204d344", "sighting--22c565f1-ec0e-4660-bbe1-7117bdb57e0d", "sighting--fb6c08da-902a-4135-a65f-1fcdd6699561", "sighting--14d2ae68-72a5-42c5-b365-110a124380dc", "sighting--36bc6cb9-bdfc-4d6b-a820-c9222f9c0dc6", "sighting--6a095fe7-88e3-4520-9282-1de3d55d707a", "sighting--5152b4ad-8438-481d-820e-a3651be4044c", "sighting--8e852091-5d5d-4ea0-affc-ce55e168d646", "sighting--55e307fb-979f-433a-bf0f-10a36aa00bf7", "sighting--8ad23854-4006-40d1-a6fa-bfa245cd42f4", "sighting--58a8c35d-bfcc-41f8-b0e9-c68dd3ec1e71", "sighting--91aceda4-b934-4902-bdd3-808b1d5cf7a9", "sighting--67f8cb22-f60e-4cb6-b957-d9f4e2443ce5", "sighting--03d5177f-9419-4325-bbe7-24b5a1f9bfb4", "sighting--208e033b-d23b-4538-8950-55c12659a386", "sighting--c919a3b0-c322-4573-b91f-b878a926686e", "sighting--0bda06bd-adc7-4a3d-ba0e-18fec1453026", "sighting--29105b3d-11e8-4bd4-82f5-f599a2eea42d", "sighting--be402568-1391-449d-a6f6-399ade6cc18c", "sighting--cef799c4-28d1-44f8-8dc2-b8d18a0ca62c", "sighting--267e66f7-71ed-4f85-9f1d-48af3f8cece4", "sighting--052aa09e-3640-421e-ac42-bba7aa8ec7e4", "sighting--5345cbbd-6df4-4b4c-aff2-355604c3f5b1", "sighting--9b8cc788-f914-480f-ac4b-9f11214d2fa3", "sighting--6a54ab22-3030-4bb3-a942-d1e9f607e83d", "sighting--526618f5-7e6f-435f-8265-b624f099fc40", "sighting--61d616cf-795b-4b4d-aad2-681211339abf", "sighting--4b4f52c6-2bfb-46b5-bd7f-57666afca60b", "sighting--810a43c1-6a25-473e-9147-e143bcd4e000", "sighting--66de0853-fbb1-4f23-90f5-e6eb55b00f25", "sighting--8b9a1599-82cf-4eb0-8551-b3646e5da809", "sighting--0c15ad8a-6513-4168-8b4d-5ac3a830b2fc", "sighting--6fb59c9f-cdde-40e5-9f70-ce51b403fc8b", "sighting--73f03fb5-7e4f-4409-ac3e-b8b104e22bcc", "sighting--c74c60fb-ced9-4515-86bd-2327d265577d", "sighting--3588201a-0878-41f2-bf10-dc820f4c1725", "sighting--4c31299c-8189-4f24-b863-b755ee21f45c", "sighting--f2b8c22c-2481-4aa0-b590-e605645cf9ae", "sighting--4d3894c5-5943-4d81-b1f6-da6513fe483f", "sighting--6ee438be-fbd5-4735-a339-78056296208a", "sighting--3e94e7f2-e2f4-4f55-ab04-3f615ac3d53c", "sighting--aaed49f0-4b9f-4564-9294-0100fab04dc2", "sighting--06f3fa54-2016-4e30-bed4-b84b3f675f89", "sighting--7717fe1c-282b-42b0-aeda-d5697602cc5f", "sighting--5239876a-e2c1-4575-b4dd-d1005fa640e9", "sighting--a965ecd3-371f-4da8-900e-3da0db1b60fb", "sighting--844a9881-8f4e-4b72-9030-ae364a4a8f11", "sighting--ba976d71-2880-4e20-8d41-420cfad1b659", "sighting--8e298d6d-ad84-4c7f-aa57-2edba898a37a", "sighting--ff88ab42-cd53-4b63-937b-d7cdab884a48", "sighting--ecdecb46-ecf9-44c8-ad8b-2e955e362be2", "sighting--05bc23ea-4eeb-4147-b152-789979e9d183", "sighting--4d2a6fa5-8301-4f98-9613-9fd32bd5245a", "sighting--88348e7b-097f-4757-b07a-58e1a7aff513", "sighting--942205dd-772e-490d-987a-0361045bcec3", "sighting--384aff8e-465d-45b6-a8ff-e61bdcfe298b", "sighting--ded551a9-5a56-4a7b-813c-260bc39bf554", "sighting--8718c20f-6659-4321-8c54-9f99b80552ed", "sighting--25bcfadf-0c2b-406d-a9d7-eef3ce6e3216", "sighting--beea2c7f-6b12-44ec-a2eb-a53dc0845666", "sighting--88fda4c6-a5ae-4fa1-8de6-45d23d482b3b", "sighting--fe77f296-aadf-4694-88f5-c7b826c4d9f0", "sighting--18e3cd16-a0be-4033-9588-9c824f8850ef", "sighting--b903fe4a-d099-4ade-b38e-53664d6b247c", "sighting--b36dd2ec-2840-4d06-bd9b-cd4def54c6ae", "sighting--42fb44ca-2b9d-4a92-b8fc-6b361e2b4912", "sighting--961f7c2a-cd41-4843-8b42-fb066a8f8fad", "sighting--f769867a-a0c4-45c4-a5e7-f9ff801eaaca", "sighting--fbf3cadf-bd09-40aa-9a3b-94102a840c9b", "sighting--1a378036-e90e-4de8-bf0e-a06b545b1706", "sighting--cf2de774-9633-45b3-a35a-f985b76857e4", "sighting--f7af411a-c917-44ef-9fff-32bc2e1233bb", "sighting--90171526-663f-43ad-bc06-fb7d266643e0", "sighting--2dc48952-b25c-427d-9b06-646d5556d9fe", "sighting--4f9b5ce4-d43b-417a-8ee2-f1052d45827e", "sighting--eb524ff4-8145-472d-9753-34d5dcef5d51", "sighting--5e46c184-7508-4e76-a389-98e742f2cc22", "sighting--f24fcd0d-75a7-4d62-ba2a-0a4a0caf062d", "sighting--3c52989d-d0e5-4246-9fb5-3df3cfe2dfad", "sighting--7b23bdd3-2e41-48e7-af67-5ca26db507d8", "sighting--c4ecfa08-f064-4410-8c72-8761c1aadff3", "sighting--eca97a1a-3724-43d4-8e38-62b35cc92220", "sighting--7ffcef46-ecc9-4bdb-b680-0151cb46fab1", "sighting--39f3c221-69f3-4186-b699-498607d7d285", "sighting--507bf281-55a8-4d45-8780-403f67be24e1", "sighting--e3d2e38b-863a-41cc-a017-178b7acfb1ec", "sighting--feb6aad9-7686-4386-ab2a-a82a2c57176f", "sighting--f140592e-58a7-4c85-8d6b-a5e6656a866b", "sighting--33c96082-6696-4722-8d20-81999051feee", "sighting--e545ae87-ae01-4f5f-9f7c-fadbff8f04c9", "sighting--75762fa0-d734-414a-8c24-e5360b94a2b1", "sighting--d0e4254d-d49f-4f20-80ac-338ec5c4ca0a", "sighting--fc80c0b6-8231-418a-a281-c2fb4031cb40", "sighting--016c5086-8ae0-414e-aff7-229f63a77881", "sighting--3e7a140e-e33e-4cd1-92f2-ec76fff6ee40", "sighting--3e11863c-0c2a-4ebf-a988-222424987de2", "sighting--4b70bdad-c4d2-481d-bc8d-7a40e2567bff", "sighting--b062ef05-dc7a-4718-99de-9163b6a5926a", "sighting--643965a6-f887-47ca-a680-8d32cdc83a85", "sighting--d8625a7e-c9a2-443f-aa71-7ad10001b201", "sighting--e492f474-650a-45e8-91af-6766dca16483", "sighting--5e68db19-3929-447e-a03d-7e105175dd9a", "sighting--6e858c2d-d7c5-4d23-bd6e-2326672e84bc", "sighting--c18d8061-ba4d-41f1-8c19-9e990f97d3fd", "sighting--73e8cd61-125f-48eb-b075-afd49f2fd2f8", "sighting--5ffe1229-fd98-416c-bdf9-c7d7d1c324b1", "sighting--61696eac-aa45-48e4-8d2d-0e781d0d7dd8", "sighting--c2c584b2-8d19-4b96-ae95-6fbe2a723aa0", "sighting--4c3d943d-5f4e-44da-9a9d-a7f3d5d4f0da", "sighting--8511b5c1-c049-4b91-ba42-9336cc0f2aa7", "sighting--1992fda4-8cee-4f83-b889-9ba0d2809b11", "sighting--361ba045-fbb8-45f6-95a7-622c87a52913", "sighting--015a3ce3-3d27-4a40-a26c-b67512df5457", "sighting--5abc1f2b-c587-4107-a0fd-bf5c37fc2e21", "sighting--2c2510cd-fae5-4083-a032-c4fd4970e627", "sighting--aa2d9f29-9bdd-47b6-b70b-c9a00d208734", "sighting--65d0cf8a-4a43-4d74-a168-b7d41b959367", "sighting--8fb9a57c-b220-4ecb-a24b-97835597273d", "sighting--4351d904-dae2-4d10-9843-7e8542268e65", "sighting--89031269-d674-4ebb-abbb-661b18474945", "sighting--e95cc89d-c0fe-4315-bb94-24a6a382f624", "sighting--77e1c920-71fc-4d5f-9570-cddad896bbf9", "sighting--374b61f2-52cc-4ba2-9c0c-48707cf87231", "sighting--e3f0f03f-3e7f-4022-868c-b8490c5ab53e", "sighting--011d6b77-cdb1-4d5f-97b5-25ddda43751e", "sighting--169eacd9-42a0-467b-990e-9fc19bd5a7ab", "sighting--84c5b015-74b5-4efe-9056-6c31d13192b2", "sighting--a77a3153-3f52-47eb-9d33-ed10c6149410", "sighting--09990cc5-d1b1-4a2c-967a-5acba6ea9106", "sighting--66db1748-208e-423d-9d99-a0c6487dbfc2", "sighting--1bed8a1b-66fd-4b73-ac99-569a83f5de26", "sighting--d72a4947-d199-4ed0-8bdd-bc1cfa58b6ab", "sighting--5685c353-905e-4538-93ec-a3106f1269e0", "sighting--fcd9806c-3ae8-42c4-b8f0-65b37a4df568", "sighting--7389d5d0-1cb9-4406-b231-9019f185e0e2", "sighting--2450e88c-bad6-42ad-84ed-90c29cb8bde7", "sighting--893599e9-82b6-4427-8933-c370436bd1d4", "sighting--405bfc06-561e-4294-b3b9-aa44ed50b1b5", "sighting--e359e078-b9cf-4be4-a75a-4e01a78f79dc", "sighting--740c5c3f-3cc0-4f4b-b119-ced3fd72ad7e", "sighting--6fa48bec-e9bd-4142-984f-20e5d0a4d016", "sighting--22507dfa-51c8-4d99-aee7-54e581eed977", "sighting--4425e82e-0a7b-49f6-87f9-1a1b4a6895c6", "sighting--d1c76e12-2d61-44f5-8527-e7ec4eb5bed9", "sighting--f77e5217-f45a-4b33-bd10-f1eaa56610b2", "sighting--2360bd35-b483-45ee-a1eb-34b5e2924a96", "sighting--0c905155-d927-46b3-bcba-c4e7ac434b2b", "sighting--6f525ee5-4927-4715-9fc9-d0e54e6d6899", "sighting--658dc8fa-65b7-4833-aa62-abef3cad5d4e", "sighting--51d5bd88-d3eb-4888-b303-2c1d97b8f7a3", "sighting--753df378-49a8-4786-82a9-4cef5225d823", "sighting--ac6e9de4-c30e-40d2-989f-7fe5eb5bf68f", "sighting--f3da3b04-51cf-4c4c-959c-c6ca627ab6e1", "sighting--c042c34e-4ca1-47ea-a088-aad7113d3b0c", "sighting--a0334a74-df65-4965-985b-063896cd8cd6", "sighting--7d345be9-32ea-416f-9ab3-5294ca17c64f", "sighting--e8a127ea-960f-4dca-873d-5544b3705bca", "sighting--b22ee32e-79aa-44e0-a6fb-658de9e9504f", "sighting--26956aea-70a8-4939-8e30-de762a1eeb3f", "sighting--eed0d195-5753-411f-a965-a0bd7922c924", "sighting--9f148992-7a91-4edf-be2d-73050a2dfac9", "sighting--28408d52-8570-4fe1-a396-ca0eee518316", "sighting--82ffdef6-07d7-4ac6-b940-355d01795d9b", "sighting--417bf18f-6cec-408e-bebe-6e9e6f8aad13", "sighting--ebeb4b80-562d-4912-a4ca-993f096d9881", "sighting--61dcf6d6-9562-4ea0-8126-1a81d2ef41dc", "sighting--3b38b065-5b0f-4360-af47-54b8f22689fa", "sighting--94d697dc-dd8d-4894-ae1a-60de732007ed", "sighting--a76494be-0980-4230-a4e1-61cee40e6c38", "sighting--66de7ef2-93d7-48f5-8d31-dd16cde79c25", "sighting--4ca23f33-4edc-4bb5-89ad-54aa6ca687dc", "sighting--da8ee0ec-477b-4932-be4f-32a9a806c9c4", "sighting--56b14f99-8fe0-47c7-b9a5-a1fd1dafed1e", "sighting--914ef49b-0ab4-4bbb-9c12-ea2a113016f6", "sighting--d66052be-3bbb-4985-8817-df8016da1daa", "sighting--8e9ee245-a2e0-4959-9e64-1ca50810e58a", "sighting--e5b9be77-a7be-4c91-9453-82a487e004b3", "sighting--e4a7f4a6-560b-454e-9549-d3d21e76842b", "sighting--aad04ef1-047c-4c5e-a51e-54092b323d0c", "sighting--91914050-0777-49e2-80d0-7f347cfaace5", "sighting--36ce6e5e-bd01-470a-a3b0-b3779d8cdb24", "sighting--374a3314-8cc8-4f26-9716-aa931e5d06fb", "sighting--795afe70-b7cd-45cd-a158-c1c80d518c26", "sighting--19e880b6-100b-4a3d-95f5-a710e5bba6ae", "sighting--28e66962-7702-4de0-a15a-31a3b10ba108", "sighting--ebc9da03-193c-4ec9-80d0-89afa594ecab", "sighting--4f7ece80-a361-4e83-acc2-376f9c61617a", "sighting--1fb7b7ff-e6ad-4dc1-9dbf-2ee65cd3e635", "sighting--857cea0d-3f69-434a-a780-9321cc6f1f31", "sighting--cc25bd51-8270-4150-8b5e-197db85618fa", "sighting--34799547-33cc-4ff4-8f58-331524461a64", "sighting--cefe9afd-dc54-438a-9196-ca4f24a6d025", "sighting--895cfc4b-2f05-4d76-8299-385b31d28347", "sighting--a64ebc9e-bd3f-4ab8-ae15-79e34f333cee", "sighting--177e9dd8-df02-4a7d-bd81-54a8f87c487b", "sighting--d7a09ce9-c045-463c-b5ab-030f73bcd225", "sighting--f9d2b08f-2cac-4b75-be04-9d84fd87f4ed", "sighting--1619c98f-fe44-4010-bb27-88882ece7a7f", "sighting--49d9f7d9-61ab-41f9-9005-419e00847432", "sighting--4ad5dbde-760c-4f0b-9c39-45176c3a3bb6", "sighting--d4d9f6e7-b0ba-4c83-ba8d-f99418d62297", "sighting--53484609-71ea-4370-b0e8-9a2e91349eda", "sighting--55cd06a7-33b8-4ecc-a4bd-4504682dc11d", "sighting--2b4b7e81-7f9b-48c4-b108-86e5373cb4ab", "sighting--97be8586-3558-4a33-bed4-c9e1cad273b6", "sighting--9ce05ac0-9856-4e41-97f2-082976b0f936", "sighting--2f3d686e-ffca-4dc9-b592-6a4706b64298", "sighting--8ab4f105-7f9a-4eb2-8aa2-c7961c930dc1", "sighting--86abebc9-a504-4bb1-a4d1-22254e5438d1", "sighting--68c35b1d-a97f-440f-9a25-67a94fb50c87", "sighting--ef96e453-5bf0-4dc5-bfe3-9b88d947a39c", "sighting--26b64fbc-16f0-494c-add8-59ce0923eea9", "sighting--15e5b37f-0467-4359-b3b2-0db52e825d00", "sighting--e5ff7ea4-8df5-495c-a522-81856e5b2285", "sighting--384043b5-10f5-4b83-a610-9171ff2c3113", "sighting--e639d9bc-db18-436f-911a-dbc47ec495df", "sighting--48eb8b84-068a-4d85-aea9-f828fa041c72", "sighting--07481b74-ad87-48dc-b65b-3dc910d4c070", "sighting--fed83efa-974d-4cfd-ab6c-e6e730698bc1", "sighting--473eff50-f13e-4d95-89a7-458f70a94337", "sighting--07ce3cb1-da50-4993-83ea-a95b0f1ce080", "sighting--3cfc83a5-442e-4557-8097-f6a151a3e43c", "sighting--9cf7f79e-a7a1-4321-a25c-672c6f96f410", "sighting--0a906908-af4e-4dfc-a59f-0c011f16a967", "sighting--588da8ca-2e91-442a-b8d1-3cfe5758c9e8", "sighting--9bb76fa0-b8fe-4f51-8eea-71657b960aa9", "sighting--3fbdcb55-2b9a-4d82-90cc-f140daa326d4", "sighting--ea3f9f71-2e88-47d6-9dbe-1209c22442ac", "sighting--92eeb856-9de2-40f0-befc-14a27b7e559a", "sighting--760d0de9-9a9d-4e9c-8371-00a92d6e2682", "sighting--a0d66a10-c184-4a55-9619-6d6ac9001cfb", "sighting--26a2b460-f706-4196-bdde-13f380728f59", "sighting--10b35e8a-a01a-4f2d-b2f2-311d412279b6", "sighting--7a10d878-3135-40ff-a1c9-68895f72c58b", "sighting--a9d77075-a431-4e17-a373-7f81e6e784c6", "sighting--db748b2d-0582-4766-8ae1-fc92373a5a05", "sighting--184eac32-a869-4233-9925-836bbf5f70c6", "sighting--f0f6dac5-908e-430a-96e5-a6643e85bee0", "sighting--9dc95e56-8da2-4cdf-a471-efa39aee5d41", "sighting--a99d7148-475a-41b8-95e0-9271d316f228", "sighting--d8b7e1a5-cffe-4e35-9d6c-127901cb32c7", "sighting--e9556185-f9cd-4703-997e-5c8b93dc6169", "sighting--199773d4-36ec-4184-9479-7920b9f3c140", "sighting--ca09dbc0-dfa7-4320-b3c0-4877aaa85824", "sighting--ace9b485-f55a-4811-a1f3-184bdf44d68d", "sighting--736d1fd7-8cd0-403e-84aa-1f0eb8b5b286", "sighting--a21a5818-5290-446a-85ef-974c1f34158e", "sighting--8267b8a7-9970-4f15-9684-56518811cc1f", "sighting--277215bd-d8f3-4019-ac36-e0565d6226e8", "sighting--2395e729-5994-4ba5-98ca-57894b259424", "sighting--2e8cfc38-f28d-4faf-9af7-2766a16dee1e", "sighting--065eb0c3-1e74-4b73-9bd0-a1f4d13f9778", "sighting--3843a57f-12ae-4dd1-a04b-8e9ee6082f41", "sighting--a7532128-3522-4c02-b03e-e0d42399ec96", "sighting--52d3a427-227b-4744-9284-883683a8dcf5", "sighting--c9b2dcde-84c8-4a83-add8-0a18b57feff0", "sighting--d503ceb2-fb50-40f7-a313-325c3c8516dd", "sighting--61c78d4d-9064-439c-a1e5-524a9a880429", "sighting--0f4435cf-eb01-4878-ac0b-a84d2a1bd51d", "sighting--a5f88d19-5a22-4a5a-a848-a3b20fc31e6d", "sighting--1cc3c988-2b75-4434-9eed-53f7704f2201", "sighting--bd14f331-235c-49fc-a4a4-16f92e990b46", "sighting--0e73e23f-9e3d-45e9-8505-d6a9c8b6d03a", "sighting--cff49539-afe2-43df-8d8d-8ff88c64b2e3", "sighting--2756c770-b406-494b-9b59-1d5995ffeda4", "sighting--e1d4b26f-34f4-48f1-8a75-b3d67d1c8e04", "sighting--98fb5d24-d3b7-4bff-957c-14fb34fa2d25", "sighting--e15486f5-172f-4188-af00-7b0eb1df4a52", "sighting--f8fa8aa0-a26c-4a65-8d66-54d35b44b724", "sighting--fa375868-a04b-408d-84ba-b9988cd63a10", "sighting--6e27ea2e-a209-4f76-ba0a-230abf22a606", "sighting--2ab5031e-54cd-4c0a-8560-de24e0af5ce8", "sighting--8255b9db-d07f-4be0-8106-6920e296ef58", "sighting--17f6aa90-f40f-49e4-90a1-fd6ff6a671ab", "sighting--612ea673-5df1-4148-b0c2-91657eb1ca98", "sighting--234d55da-684c-4665-a1f4-effd20ab333a", "sighting--fbfcc69d-5cfc-4fc5-b4e5-69a588aff687", "sighting--292e1033-51d7-4cad-9a7f-21fbf93eec42", "sighting--5c089750-c046-44df-bbcc-46159beb9785", "sighting--28dc5d99-493a-460f-bbb6-b68d27ad46bb", "sighting--5211a999-1e33-4551-b908-db9777f0c497", "sighting--5835a72b-56bd-498f-8c19-88adf47e0695", "sighting--e4c0a7e4-0f24-478e-bf94-77349684a064", "sighting--4469be15-11e2-4238-b686-7b282a37803d", "sighting--d0f32ab2-b6a8-48c0-b61a-d3fd351b63a6", "sighting--ba904567-cbec-4963-bf46-a7b707d55d47", "sighting--e99b9512-042d-4eee-ae3c-3dae955879bd", "sighting--e540d1bc-73fb-49ea-80b0-c31ec13bc3ec", "sighting--1316e7ab-17cb-4305-8c4d-725149158e1b", "sighting--eb980edb-2ed6-4421-b3bb-7f540598e318", "sighting--aa0339dd-84f8-4630-a8cf-07e8f24fcfc6", "sighting--9a23aecc-f781-4cfc-9079-8314667151fe", "sighting--1300fc5f-3071-45ae-a9ff-c97bdb9ad877", "sighting--a040e6ea-7059-48f5-9b0e-fb1021965cb3", "sighting--ff8c658e-098d-4afc-a6a4-9a02ccf62e7c", "sighting--b5016238-08ab-4229-a039-51b0e2a7fcb4", "sighting--e9cb4a82-5099-4355-83d4-a36b385b31ba", "sighting--b67f7e9c-f46d-4d12-a423-cc5e535235c3", "sighting--04054881-234b-4a7b-8be6-613f03f8b093", "sighting--9d69a083-f979-49dd-83bb-56069da7155a", "sighting--82fc4b04-4e87-49e0-9a77-f0c8216bcd58", "sighting--65b5e3ab-d8ea-41c0-b8be-a7c7a2b22829", "sighting--df20d865-6b2a-4047-8194-86c2aef18722", "sighting--6d272d9a-4335-41ff-a66d-abc93e838ffe", "sighting--8714c1f8-3586-4b46-b202-5daa0f19173a", "sighting--4deda307-3356-4726-bf8a-273792e8607c", "sighting--577baf50-0c5a-4b1c-a6fa-6d8f5d146f5f", "sighting--ce34cd82-4960-4086-b845-f11632c91116", "sighting--543e2abd-835c-4227-a75b-1a03ea4b3a59", "sighting--6ae1bb03-9d9f-4b72-9471-d1db73402f6a", "sighting--da4dbc8e-19fb-4e83-a727-cc0063c0ea12", "sighting--006b1ffe-08cf-413b-a3b6-27480f6acf92", "sighting--4a5dd250-7677-4f81-a91e-9231894cde9c", "sighting--cb6f4209-3e60-44bf-a400-d58da9eb5c54", "sighting--3108a7d2-5982-4171-a661-76eca1bcc74b", "sighting--de66d377-1de5-4b1f-a396-c89fcd4144f1", "sighting--ccaa0fcd-5657-4e87-b8b6-26ab682c0da2", "sighting--6d9bdedc-473c-4d82-a609-ab3ff3294873", "sighting--beab155a-6008-4de5-9fb5-6df3d8e9c7d0", "sighting--5a558255-d439-48bb-a2ee-79b28dc09d9c", "sighting--acab9664-9cbb-45aa-9a2f-7ce7adfec272", "sighting--5cd8abf3-4da6-4e2c-99da-13bdfe3436ba", "sighting--dad43d68-9173-46f6-9e7e-af1f6fa63601", "sighting--7f3db2a8-4a4d-4407-99cd-31d85a0890c5", "sighting--a7f0fa7a-08fd-470a-add7-ecf623f2354f", "sighting--be84c49d-fb3f-45d3-b616-7c7bbee8c6e7", "sighting--d8eaa56e-c8fc-43c9-b9ac-2bebbfce678b", "sighting--620e6df8-2a8d-4066-86ee-89167245f3c0", "sighting--d6fe5664-6105-4555-bb27-ca0f3251cbcb", "sighting--49ee452e-8bf2-453b-9578-e6948ea61c83", "sighting--de490df3-ed1b-481e-9342-0386ec139519", "sighting--8ef62af6-6c5d-423b-afe5-093726adad27", "sighting--c30ac978-aeb5-442a-8faf-3aa435cc38f9", "sighting--c1eb2927-bcf0-4520-9b7a-ee06d04ca2ec", "sighting--f29bac9a-8c80-4589-a297-cdef6fa15e4e", "sighting--fc45a6d6-80b3-42df-a5e6-5a18799099c2", "sighting--fa40a38a-d00b-428b-9041-0958baac2a07", "sighting--afcc8616-34fe-4c31-8912-921b077c3e69", "sighting--6d6b5738-ce85-4c77-9a4f-24eb8fa6cdd3", "sighting--9044993a-4325-4eb6-a2d3-d8a47db0d15f", "sighting--932965d2-42a8-488b-9317-b0d5c12c2ce5", "sighting--611b8121-2a9b-49d8-be62-d867d43f9413", "sighting--94d6da52-b764-4efd-9755-2cb3cb3fa6cc", "sighting--14223043-97db-478d-8814-46f4ba9cc44d", "sighting--7c374839-e549-4030-ae53-066f2e831108", "sighting--404c721b-3088-42f3-acc8-e69ca8ab0e52", "sighting--ab438fb2-2cfc-4acb-bbb7-895f5619e8e5", "sighting--427235bd-e60c-4481-99aa-82a348209b5d", "sighting--3f3e3b92-e992-47dc-aadf-7caf0f20b384", "sighting--ae6042aa-bca6-4120-8f8d-b7b3ba71593c", "sighting--8f1d74ad-2ebe-4eea-af25-0c45a787b997", "sighting--c90c24c5-19d8-4240-993d-aef05d4a15dc", "sighting--c32a7548-3ca3-4cd5-8dbc-be859ae377f1", "sighting--94a5fe2a-6b5f-4992-8117-601855594204", "sighting--3ed5ab0b-1109-4ab0-bf36-6b3149d59dcf", "sighting--2de6dd49-e973-40de-a9d9-628216135293", "sighting--a78400df-9aa0-408e-b1cc-3ebe1de532f5", "sighting--feca6c4a-59e2-4dcc-a53e-1961790a1f6b", "sighting--600dc178-4b4f-4583-a615-ed986eff1820", "sighting--2ac01491-d7f6-444b-a880-9cd0c4fb73b9", "sighting--fcf0f1e6-233a-420b-954d-cf2f61c9d214", "sighting--768600eb-999d-4c6f-8774-fb5819c86c2a", "sighting--a54fd58e-e180-4595-8229-f82f82e0638d", "sighting--af6eccfc-e91f-4f07-81bc-700d62779290", "sighting--4238bf09-5793-4409-a783-cacdca922d93", "sighting--94d01df4-6449-4d27-97fe-a7036fb2a63e", "sighting--af93d9af-34a1-4389-824a-77da1653deaa", "sighting--54bff95b-7b09-4976-9b03-0e4083d27796", "sighting--539b8177-a1eb-41b9-894d-94cf2854f577", "sighting--ad66969d-cbc2-4d26-99f5-debf72ceceb1", "sighting--8c13e066-921d-4876-86b6-6bd3bf57982c", "sighting--1961b11a-c3d8-4590-88b1-5eb501021070", "sighting--f35340f4-2566-4d7a-8522-bf56f3cb8332", "sighting--7bc483dd-74c0-4bd6-ac27-249ed9369fd9", "sighting--bf801920-61ed-4c33-a2da-d02356004602", "sighting--3772b5e0-b22f-453a-b5a0-137898653f9b", "sighting--1eaa9168-4bca-4736-abce-e07b3491faa3", "sighting--b5a5a0ea-0b7f-4b84-b36b-9155ff456da7", "sighting--8f94f0b2-c6ba-4379-964f-2e620d34a979", "sighting--9c735526-0f1f-40aa-ac99-225697b4f253", "sighting--383e4e24-24f1-4552-a3a0-e5ef947921c6", "sighting--d4565a5e-072b-43d7-b44e-e1ebb13f1099", "sighting--e54907ee-aad4-48e9-9883-ac38062be16c", "sighting--974e99e1-bd1a-4af9-874f-ec505ace62cd", "sighting--93990590-e051-43dc-87c5-b26765047a61", "sighting--2337d6c8-2d71-4f80-8afc-f5330a7ad461", "sighting--3f16959e-1c3b-4053-8a3d-f3bdfa873928", "sighting--f2f871dc-f9c8-4486-8cc6-3d426c77ece6", "sighting--8f9a6f7d-d541-42b7-90f7-23f56ce7b207", "sighting--e9d63dc0-a095-4c4f-ac26-08bd7b9257d9", "sighting--132f0bc3-e49f-4267-adfc-86ecba9ffe26", "sighting--b273287a-2b98-4e73-af0c-499f3d206d21", "sighting--2148f0c4-02dc-4568-8d97-d731d8c6441b", "sighting--2871a636-7514-47d1-ab7c-e63d67233271", "sighting--6326f50c-c356-4c8b-ae83-98418e390b0a", "sighting--4fbd5963-9bdc-49bd-929c-a80f915840f3", "sighting--65bf67db-74b9-4586-8952-609ce0f42921", "sighting--65d42e46-1e73-4ce4-9d73-5845322ad258", "sighting--3b102c68-daaa-405d-830c-e24cf8b10a82", "sighting--36e25181-4b66-4661-8082-037943dbf65b", "sighting--418fc85b-0426-4d78-93a9-9cd63de6748b", "sighting--f1d77115-8016-40a3-856d-9c0a00cc237d", "sighting--818d0090-ae71-441b-8cd9-f4b9f6594c7e", "sighting--8c892437-d447-4c49-a4ac-18fb9ba9d829", "sighting--c5f9c683-399f-477b-831d-319f91fccf4c", "sighting--bb891cdb-fe11-4b36-b761-54bb533bcffd", "sighting--9afa3787-bf21-4e53-bc36-7d8857f92926", "sighting--503f6ee3-e5c3-4395-af2c-1c0f719f864b", "sighting--94007eec-eb41-4e3b-89f9-bcba1554254b", "sighting--f92c63a6-22af-48d7-885d-bf1c7ed5599b", "sighting--d2337f8d-928e-4dcf-878f-028544c75d1b", "sighting--039e7435-cbf1-4c69-acaa-2f5a537fba84", "sighting--90592490-9574-456c-9ff0-2157ccd7b501", "sighting--21e3bd86-40dc-47b7-b209-940941ff1f98", "sighting--5dc94401-9a06-447e-a335-e50ef3d5d72a", "sighting--a64a872e-ed24-41ec-b8f0-5ed1aa7e1b22", "sighting--77051ed0-4c0b-47f2-9531-956737fea9da", "sighting--db50944a-040d-412b-bf05-eacabbf646f9", "sighting--a60a35fc-2323-4ae8-b602-994a897c6c67", "sighting--ea6fcd02-04ee-4cdd-9999-683a039383a9", "sighting--5104d530-20de-4f2e-885d-927ad1dea525", "sighting--9cc0158a-5c65-4476-9c38-4201589349c6", "sighting--d9c70c6e-803e-43a7-b69c-c1e982fdf4cb", "sighting--210de0ed-56af-4988-8d56-9aa34cff9184", "sighting--23beeddd-c661-4b4e-99fb-f5947b1ba996", "sighting--2e507fb6-84c8-4826-a103-92365d2c7368", "sighting--92b6886f-3cc6-4019-a3c1-93e9d464d474", "sighting--de4d4836-027c-4d73-8515-25fb8ce84363", "sighting--594a43de-1e31-43c9-b29a-de7f2cdf60cf", "sighting--f95e0d8d-3839-42fb-b65f-1f9a914faf85", "sighting--817d9f44-a8f2-4467-9962-a05bb2df4298", "sighting--e28a7875-00c7-4f99-babf-4185b2b70567", "sighting--33dc2ff6-9aac-4e9a-8c18-440c6be14019", "sighting--361d2453-b86d-49e6-8078-fb965739a6f4", "sighting--88c3cadd-201b-4f26-80fb-3d04d3aec678", "sighting--8ae79543-5728-4448-b987-732334eb806e", "sighting--d7f2f848-6a27-47f8-b08b-eb47cd73f673", "sighting--4e237127-3eb1-4ada-8f93-f9c625f5f705", "sighting--47352f1c-e868-4aa8-8387-e9ab3794f542", "sighting--367a5930-c880-4f81-935f-b723042a52a2", "sighting--b4d0a719-e936-4aa0-9671-c2ad628175b0", "sighting--bac29ff1-88ae-4db7-9722-04cbf23a8171", "sighting--9410e4be-6348-4e4b-a7c2-cc1c2d345969", "sighting--be54aa81-4040-41d6-8ac2-e55d6cccde4f", "sighting--300cc563-87bd-414f-9382-3d9628b9c2da", "sighting--cd72187d-8c37-4ee3-9344-90b6afeefcbd", "sighting--ece52687-08be-45ac-b53c-56a1119a05a8", "sighting--fa55bde7-896d-4d81-9798-24a3704ff42a", "sighting--b17b54f3-6e28-493c-b9b6-f1096d1111cb", "sighting--8d963e20-8516-47b4-b58e-1cc2e9a23e6e", "sighting--b5963447-34c4-45f9-8d9f-a2a14bf72a0e", "sighting--ec264a5b-673e-4b6e-806e-24b0278e7596", "sighting--5cce7f00-3277-477c-9ddb-f9b738512d14", "sighting--198f7dc8-a3cb-4e31-8bff-ea98ebaf069d", "sighting--67d28be7-f864-4f0a-8a8e-024e9fba9198", "sighting--3eef4404-4a75-4d4f-8b8f-bbb1f9b270dc", "sighting--7fbf3977-0ccb-4704-96c8-31e502726354", "sighting--032257b5-f0e5-4d67-bc18-85ca6e6a8924", "sighting--c06d6d78-0a20-4813-8c0a-507b22b0fbb8", "sighting--7d0455be-d369-4842-8c08-8b974e300ec1", "sighting--c58f2798-f0ef-4b2c-914c-9b35c4c094b4", "sighting--a566127a-ebae-4241-96cc-c4e2421e007e", "sighting--80416926-8201-4a9f-a285-f7dcd1ed0e76", "sighting--48d88f2a-296d-4e05-aa4d-cbe3f33a5dd7", "sighting--7025f9a8-6391-43da-9a45-7f093ad9d785", "sighting--7c3ac280-7e49-4a0e-9f34-5561b21025fc", "sighting--abcb40f9-04dd-41c3-907e-1df33746506f", "sighting--78ca548f-c9f6-48ad-aac6-92cae276ca80", "sighting--8d045e04-8b2d-49f4-8818-1d050b525e89", "sighting--bf6aa39d-a00f-484f-a932-b2bfac24560b", "sighting--303b50d7-16b1-4233-add9-013082916666", "sighting--bbbb7c1d-7fd7-4cf3-8483-87c539329edc", "sighting--fe17ba06-3a52-4b0e-a9f0-e888aaf5c2e0", "sighting--dec5e8f1-a373-4542-bec4-5d294f7848f6", "sighting--7dd4ec0c-c519-4d32-a3f3-2c572a6fa402", "sighting--fd6830d7-8290-4de0-9461-abea148caf79", "sighting--3479ed8a-cef6-422d-989e-30180aee63e0", "sighting--8d84a570-2e72-40cc-8799-7e7ffd4d55c4", "sighting--70224779-d3e3-469f-a83b-fd74ef91931c", "sighting--569e1d24-37e2-451b-a3e1-3c877c923b1f", "sighting--44216c8d-af49-4397-beb2-77a1b1db0151", "sighting--a1f6ef1c-f2bf-434a-8c60-f8a13eaa082c", "sighting--e73b3fe4-6d08-49ec-ad47-26e7572d4cc1", "sighting--ec49fa87-6fb9-4a5e-bc3b-c0469e74fc61", "sighting--a53a0fed-1622-4ebc-bee0-1ee72e5ac7dc", "sighting--92a4842d-0fce-4c52-9a4b-57c0b9535ed1", "sighting--6e3ea780-3b57-4fc2-b818-17f7c9a84645", "sighting--ecd497cf-f6b4-4baa-ba23-0ec8494e7b25", "sighting--f43a2983-737f-45d2-9510-30c23747ee44", "sighting--5f9f96ed-88c6-450a-981b-bac500939183", "sighting--8504c9f5-6152-4e7d-a23c-db5b9d25e10a", "sighting--0b2372f7-88bc-4834-885e-f8151e793a63", "sighting--0ce3b75a-8dad-4b79-afb9-d6c36d1be3c5", "sighting--3756dd3e-310d-484c-9a75-bec809c8a660", "sighting--a3059c1a-818d-4282-b98f-c63820dff07e", "sighting--4977140d-343f-4d69-a0a6-9362d5554063", "sighting--284352ba-9e7e-4e9f-8008-1735e343ee9c", "sighting--928215cd-bdc5-46a3-b8ca-8c42ac295e66", "sighting--bfd03516-e72f-424b-a202-0f9363cd8aa3", "sighting--42957d37-ea7f-4a53-921b-8ca8245699f9", "sighting--f524a5ce-fcc4-45f9-ba76-d271caa80457", "sighting--3e96ece4-5dfc-4363-b1e0-795830ff3a02", "sighting--9b6602ff-12b2-4e04-a903-443b96b7e9fb", "sighting--1a6d5869-6844-4b9b-9316-65a013ae5b08", "sighting--72a8fad7-4212-4680-8e37-d8df31789839", "sighting--afc37436-a4ba-472d-a88e-1335984a049f", "sighting--78a464b6-8ed5-4d83-9e69-0388169e0412", "sighting--120b9b3a-66d5-4ac9-b9b1-d94344215cbf", "sighting--4918b2b6-b6de-4909-a5e2-fd1a47de391f", "sighting--ab51e606-5023-4eaf-b120-1ba5d86541f3", "sighting--7034c5ac-a160-4a0a-a248-2921f36f648c", "sighting--4e80eeb2-71fe-4756-87c1-195ba6ea9ff2", "sighting--f7b77a09-3f21-46ea-bfe1-b82c015715e6", "sighting--8ee52b7e-bf88-45e7-8c7c-af2225a0eca6", "sighting--42c8b326-6c64-411e-997d-a74f295514d3", "sighting--ae21ebe1-ad81-4607-82c2-e548d0c72cca", "sighting--2d24cac4-be93-42b8-bded-598fa1c0b6c0", "sighting--36ab378f-3277-4b8a-a51d-4427b69dfc45", "sighting--8fd140d1-dd7b-4dca-b486-118ec4fd1570", "sighting--fc8e8e55-f69b-409c-a392-88205e72cfba", "sighting--5dd7ce61-a4f2-486e-ad5a-c6add273e24c", "sighting--43c9e0ed-7e35-4717-a8c7-174b7a5fb066", "sighting--addaf33a-09ed-449b-ade4-1bee70dbb64d", "sighting--4bbfb2d2-a87e-449f-83bf-dac5316ad55e", "sighting--5b14643e-81f7-4885-9925-4a2e2cba66ee", "sighting--05491033-8fc8-49a0-bf9f-5bc090dd2bfc", "sighting--e73224b8-0052-485d-ad97-d34103f7a969", "sighting--a4ca36d4-3696-4796-9a7c-329a555cd300", "sighting--717fd9c7-9abe-4c57-83e0-99e8ee7c07fb", "sighting--7986d796-fbd7-443e-9c6c-90fd0aa770c0", "sighting--b4631549-e87e-408a-bb75-1c066c61a5bf", "sighting--31211e57-e5b6-4121-a26e-2f4ca51e0e5c", "sighting--2f190e4b-4b16-498a-9fee-d7a7e6aafcdf", "sighting--6a9d757b-23ae-4977-8359-39241f44437f", "sighting--fc6307aa-2975-4ffa-8b63-b058f323f76a", "sighting--34ee6bff-033a-450b-bee1-9d7a9d16d21b", "sighting--36a7c596-28b0-4b6f-89f8-81856f8d2fe2", "sighting--b90bc67c-cdd0-4f83-814a-1783ac4c05fe", "sighting--20f52024-3f97-432d-9d4e-71f5b12c5bff", "sighting--f63d398e-e417-4bb3-b453-2b648967ddd3", "sighting--439a5e1a-7544-497d-a146-f9c758c7ad6c", "sighting--85ed9232-3533-46ed-9ed9-98b2092caf88", "sighting--a4cde341-7959-47c7-8ec9-447c06eb16b6", "sighting--a3fc5e66-4cc1-4e1b-b2bf-795d67257903", "sighting--ff5b7523-b966-4d39-b925-fb5789761df1", "sighting--4408f512-f219-4831-a545-b36aa399bac3", "sighting--113478c9-a02d-47ad-b7db-bc763adadaea", "sighting--8e7a40dd-e291-4ad9-be46-d339b44dbc49", "sighting--e9ed33f2-0cb2-4957-b549-7f9b76b81c58", "sighting--8c675311-528d-4348-ade7-7f7a6fade2fa", "sighting--8cae107d-bd5a-497a-b639-f4925cae7a33", "sighting--7363940e-242a-4126-b8af-4f8e4b103702", "sighting--4c9d0908-f10f-4da3-b5ad-4dc7face4585", "sighting--76c8a788-0d31-461e-95c9-0d73bcea374f", "sighting--55a5095b-be26-44fe-ad54-c7ba7d99cb07", "sighting--328332cf-fcd7-461a-8843-1a76a9a08d16", "sighting--d811abaa-9a71-4f68-9215-22575b6bb97c", "sighting--5bd9c0ed-fac8-42d6-81d4-cebc422e998c", "sighting--aeb23054-f52d-4465-ab3c-0192edd3df1c", "sighting--57a8db0d-7fe1-4b4c-ac48-d083264fa93a", "sighting--eacaed7d-d92d-4f26-ae21-9bbf63875471", "sighting--99184885-195d-41d4-b3b0-2dd5361a0ef6", "sighting--769447d6-5bdf-4cc2-892b-6c841cfc2866", "sighting--194852a7-c57a-47ea-98cb-73df374e1c80", "sighting--7b620a15-97e8-423b-bc32-2524ed985bd6", "sighting--5f0a6a77-a386-457f-b16b-f18c1d50ef8c", "sighting--debed114-5810-4c16-963c-8f57048ac2c7", "sighting--ca4c269f-5dfc-444a-85ee-45980ef2e8f2", "sighting--d46a737b-b72c-4c91-b5c5-dedb180c0b9d", "sighting--3752afa1-4f9d-4d10-8907-82ad392efd9c", "sighting--199932c3-ebbe-4def-beec-bdfb215e4fef", "sighting--d4d65dfb-ddb5-43f0-825b-9e3b0b62bd98", "sighting--943055ea-e8e6-4d98-85b2-7f66e38289af", "sighting--67220718-82a5-41d9-96b0-934b4638be4c", "sighting--71237571-1fe9-4304-a3dd-ce3a390f648a", "sighting--3d029f1f-3105-4505-8b79-6c1dd8a447f4", "sighting--482a41f0-68e5-4f70-998d-1bdd95a46c3f", "sighting--87a09b2b-e20e-4d9e-a48b-f44c41a428a4", "sighting--ca36815b-2992-4a5d-859b-37f247767ae2", "sighting--1b44ce5c-5a32-439b-8fdf-6066ab7156da", "sighting--1dc19a7e-017a-42d7-ba4c-945bd2ea2643", "sighting--6cc314aa-1303-42b3-8464-3bbfa2c8c987", "sighting--34eeecbd-ba5a-4685-9fd3-afa8cfd013a2", "sighting--ab1cb6a7-6910-4621-82bb-d70224cae0f5", "sighting--ee535ddf-ffc4-43a2-a750-7c39a15ed6c1", "sighting--8ad72f54-5c46-4911-a322-479adec4de79", "sighting--68ad9942-6037-4567-bcc3-12db745787d2", "sighting--69b23eb7-340a-4c60-8e54-5a0455bd091e", "sighting--d27ceecf-8ee1-4a65-9109-f24a699cd11c", "sighting--1084a682-09b1-402b-a836-4f0fb90ca8e4", "sighting--cf534dda-5835-4630-b8ce-e32535294b26", "sighting--d3945c2c-6f3c-4c0b-8b5d-3c8ff7758966", "sighting--4e579dbd-7cab-4410-b69e-15733f6cf414", "sighting--b9cb96d5-bfb2-4956-97b4-cdb7731bddbd", "sighting--7296ef70-f59a-431e-9b78-d9fd20a3b7c5", "sighting--92a3adff-d16a-42ef-8562-af8585fe5103", "sighting--2c09527f-b4da-4728-9999-0280e6f0a410", "sighting--a9b2218a-0df9-4ec2-b6eb-6b9a6a2ede94", "sighting--80db4e42-3a53-421a-8662-64f2b1d4d365", "sighting--76da8378-6b6d-4f60-b97d-5bbce2c6cf63", "sighting--22d2122d-ac1f-4eea-8f1c-99bf224a4ba3", "sighting--931bf7e3-3e9e-48a7-a7f4-cbc89361d07d", "sighting--e0e8e797-806b-4f37-bf00-e227a58b964c", "sighting--0a48bee6-a077-44eb-9d20-286becaaa07d", "sighting--0f22b7fe-ee25-4f51-a7f4-a4ae184e29ed", "sighting--597aff1b-de4f-4bf8-bb31-d45e382dd8e0", "sighting--9739f91e-a9f8-4e14-a27b-ec371b81345a", "sighting--35e31a62-e4cd-4077-b28f-47b7a85c4008", "sighting--e162ec9c-342d-4a66-971b-eb924fc1421c", "sighting--a8bb1041-4e64-4332-982e-f5806c7ce4f8", "sighting--1fd09c0b-0b76-4e2e-87b7-245bb4cae898", "sighting--e5899946-3c72-4cb3-bd0f-1af948ed922b", "sighting--a734dd43-42b4-4420-817f-0854bbe78467", "sighting--9cbeb858-c7d8-49c6-97dd-f6e2c29fa706", "sighting--65b93364-f6c4-4d58-ae1f-70522690e116", "sighting--900ac0f9-3655-40e8-830e-e9e11b3b270a", "sighting--ac8583e7-750d-4c65-af7d-3a1dab7489db", "sighting--70ea5873-205f-426e-8084-83ca9da92c10", "sighting--2c5b2a3c-511c-400d-9aa9-b006f582e318", "sighting--e630532b-5009-4768-a748-f32378b72ce0", "sighting--43d2f353-679f-4752-9152-1b811aeb99ce", "sighting--a4986227-acad-43a4-bd98-2258cd6e6d96", "sighting--91119fc8-7116-4efc-9009-1614f64d0033", "sighting--d688f5da-31ac-4f6b-a425-fba67e7efe4d", "sighting--e067d143-9940-4f4a-ae9b-2c0b8981ade3", "sighting--965948bb-7bb6-4cc3-a793-69fc69282259", "sighting--10050f53-36d8-4219-9e9e-b47887540a31", "sighting--b8f1bb20-b0ea-46da-8828-916dde57b228", "sighting--2bb2b583-76f4-477d-b6a1-88c912e06e79", "sighting--fce99f41-5fbe-4bbc-b3cd-f7f59b790ed3", "sighting--4968b5c9-d3ca-4396-bf83-7bfac460ca04", "sighting--5d3da8d6-312b-4315-8bc6-591897510e2f", "sighting--645f4aad-6701-4c86-804f-ba65716ebbb5", "sighting--9715f8cd-34e6-45b7-ace6-eb2e9a7bf5a9", "sighting--07ecb4c1-7fe9-49b3-8a80-f78f61c0f3d6", "sighting--5c421e56-5155-414a-9e93-9e6bca98ed77", "sighting--9f406093-6e8d-4e2c-a088-a5413362d2e3", "sighting--383d8173-b7f9-4c44-b6a4-1b936bda43d2", "sighting--dfac7908-c9b7-4513-b5fd-63274ad7c3c7", "sighting--a7cc69a5-cba7-4965-bde7-a23d3fe84154", "sighting--c508c5cf-7d8b-4a74-854f-95f7ef0254fd", "sighting--93c23b88-1abe-4033-8f17-e9f430f7e531", "sighting--517a036e-3210-4689-8fef-f929fc447fae", "sighting--97cfe7f9-3141-421a-ba5a-19c9ee488e47", "sighting--8b67997d-2c6f-4445-b49c-ad58c25adc11", "sighting--d34140ca-aa5b-4e6c-b853-94ed04417a02", "sighting--ad70fc95-d1fe-4faf-a423-c1ab16de16f5", "sighting--bf4aac59-da27-46bb-97f5-7e4030b0d687", "sighting--3373ef29-7865-4043-9c2c-2f9302a30558", "sighting--16fd1e5e-caeb-4068-8e2e-9b96f5b25444", "sighting--0706310d-480b-4d09-841b-91754e109a6b", "sighting--23357918-054f-4a1c-adec-84cd3b44ea76", "sighting--12f504ef-5dc4-45d8-9280-fad95c5a6733", "sighting--e619e391-52d8-4b69-b44a-210c82b6391b", "sighting--80141be6-9ea1-4298-ba54-e746fc759c0e", "sighting--e6778a30-217f-414b-9339-3840fd9fb412", "sighting--4a08abb9-d56e-4665-a964-5abe4b3e0ee9", "sighting--08a087f7-1bb4-4712-811c-9e46312d6620", "sighting--b0e40fce-d04c-4d37-8e10-0dd7365db441", "sighting--fc7132e5-fa44-47f1-8104-894b796aa52e", "sighting--866677bd-49f4-4e6c-96e2-40ebbc4c0f45", "sighting--dc91a57f-8bdc-4d01-aabd-908be1178b99", "sighting--61e93c33-58f5-404d-8ae9-0a89ae15371b", "sighting--08b66484-c5aa-4df9-ba90-5eaa55f72ac8", "sighting--89d07cce-f5af-475d-89bf-8da4988cd5c6", "sighting--46773ee1-270b-485b-8734-6c954cf8c6fd", "sighting--e7955e03-4cfa-4230-8dcc-89e061a41628", "sighting--9f3be4ee-7e22-4743-8d99-a3f0ae0f402e", "sighting--b25bd4ff-1709-4d76-8dd6-678969b65f96", "sighting--12a7bc9e-e178-4f8e-b5dc-d652b85da1fd", "sighting--e3a28ec6-1453-4ae8-b3e6-2567bd1fe240", "sighting--9db86a40-6394-4b60-9092-998a587cb968", "sighting--6fa74f52-f897-4db3-a2e5-a76d01b603a3", "sighting--d3a63818-ba51-4054-b2f5-b2387123f52a", "sighting--b26ea88b-0e1a-489e-9a0f-a2849a570a10", "sighting--3b325fbf-d628-4f9a-b826-5bd7a25c864e", "sighting--5306cb15-6e91-49b8-976b-6f77e75ba286", "sighting--947d355d-babe-4533-a99c-9b86044dd598", "sighting--a2e2d0d0-dd3f-41e5-9feb-f569155effe0", "sighting--02e2fb41-6583-4b0b-8853-341095816bf9", "sighting--130e009c-e2fa-47d9-8350-9089a0ebb92a", "sighting--788d4988-bb4e-45a8-86ef-e8e538b5204e", "sighting--04595cb9-cf41-422f-ad92-37906e21b449", "sighting--4dd82523-d71b-4323-a07f-033c1a5de332", "sighting--4eed0f72-4a29-4f5a-8465-363447ae1d77", "sighting--129f6a10-2510-4768-b70b-2c3f62cdf828", "sighting--eebffa58-e21b-4ab7-8128-0ea2d1014366", "sighting--bb8ee3b8-04f7-4916-95d1-34075526ef2a", "sighting--c49daf94-49f3-4292-ba4f-c22ec967d727", "sighting--3ee84b62-f394-47f6-8010-74dc55055b53", "sighting--4d3c4f52-52c5-4aa3-9f2e-734f9dd7f9e6", "sighting--d9e17d67-e8b0-4c81-be8e-b9cd2acda737", "sighting--8d249117-a737-41ab-9ade-754820f00bde", "sighting--557c2ed2-155d-4bd7-a270-36607c06fa1a", "sighting--d7c7a561-16d1-4be4-bd52-3386ad730e4b", "sighting--8da93ff9-b3b8-488f-b45d-419b6ccf7aef", "sighting--b7395d8e-1fe4-42b5-9660-326d6d7dbc21", "sighting--68809cab-560d-493b-93e8-05ff2681d1e5", "sighting--c97f7d50-03ac-48bc-aed4-a98fad7ff558", "sighting--1a1b5272-e433-4224-b8fd-28290db4e62f", "sighting--53e018e0-d3f2-4be0-a826-0ed15ed633f0", "sighting--80181afa-29fe-45bb-bc2a-1f164ebfda24", "sighting--a0ffbb94-a64c-4d1e-a441-9b043f18cb09", "sighting--a6790d3f-08ad-4365-a469-a5d24377cfa4", "sighting--bec27785-28b3-4bf4-8a6d-160170a58140", "sighting--27b51b49-dbd7-4dd1-bf87-c6443521bab7", "sighting--957e09a7-efc7-4d9a-ace1-a46a79315e84", "sighting--3338f6a6-046c-42a0-8a48-4fb37a988265", "sighting--81948861-2aac-47e8-9d17-66d1a69c0b28", "sighting--359dfb20-0a58-497c-9c95-015fb1372539", "sighting--278cc49f-07a0-4e8b-b6b1-a87271870fae", "sighting--0e491421-b5eb-46ea-b3d1-8f471e61d93a", "sighting--05896d9b-4a8c-4e82-bc9c-4a10028b28c7", "sighting--306020dc-5d1f-44f3-b052-e16bbf16d782", "sighting--7139d307-30a7-4ee8-9ac2-955418e8c1cc", "sighting--b2d73d55-fa88-48fb-be44-d125d8e4827c", "sighting--96f85d00-b25a-4431-a5ca-635097abfb12", "sighting--d649988f-d739-499d-b42c-048fcf27b3d5", "sighting--eb0bdfa1-a292-4d22-bc14-21be83bf9b4e", "sighting--e851193f-5059-4d75-a05b-e9bc400a20f5", "sighting--11cc6705-49d0-4726-a821-dd1854a74ec7", "sighting--79eba4ac-8488-447b-b220-af3af5ed5400", "sighting--fb7dc3fc-5cc1-41c5-8e93-fa5570409a41", "sighting--7a882987-387f-43ed-b2a2-7effa748d33c", "sighting--0416fd70-6079-4ecc-b763-2e32d136ff5f", "sighting--d46acbdf-c397-4f08-bc2d-605493370087", "sighting--25abf59f-b093-4b07-83b6-16ba3e8ddcde", "sighting--7d8af12e-8234-4600-bf20-3ba3777438c7", "sighting--11be25f6-67d2-426b-8056-8ad40939eb6f", "sighting--ff6ba441-eb4d-4ba9-9806-54dcdcf97043", "sighting--ae508801-1bb1-4881-84c3-d89b54b3d470", "sighting--308f0bf4-bc1b-4a62-8ddd-4d41f3353a2d", "sighting--d06a7a92-94f0-46ce-9b44-e9753c828e8c", "sighting--c4070b2a-b6c1-49b5-88eb-debb901f4f05", "sighting--f9b6665d-90e2-405d-ab98-ff30d854d3b2", "sighting--6df37401-7fa2-41ee-8126-6a29862d420c", "sighting--eaae4904-02d4-49d8-aee3-8484b07ac4d9", "sighting--0aec20d5-a68a-4271-9285-b73162693ec5", "sighting--87409efb-855d-4a70-9044-7f83b67fed27", "sighting--11c0bc73-88b6-4d9b-b8b0-1a54037f349c", "sighting--227ba884-beda-444f-9b10-ab6391e3f2d5", "sighting--bc1e36a9-96aa-4230-8c3f-52fac6c72369", "sighting--1f860e22-c193-4ff9-9584-e58556f3d995", "sighting--439f6039-53be-4172-989d-863d9bcf359e", "sighting--c0feafa3-cfe3-4236-b2c6-12363092573f", "sighting--e6d01d5f-1678-40ed-9f6b-7caaf01dff24", "sighting--e5a9dc71-8964-4ee7-a078-9ac784063ed9", "sighting--218257eb-76e5-4201-95d4-b6d4e8ccb300", "sighting--cbb2307d-9dc8-41a5-b0d1-d654e2f7f343", "sighting--9f583f1c-a138-4ec6-9e63-7bfce04d637b", "sighting--48f46342-250f-4ac6-b30f-cbad42ac6bee", "sighting--73ab2b4d-7b29-44b5-9d18-c694acef7935", "sighting--20627e6b-9a74-4d7a-b9af-e1e906993cd3", "sighting--0766632b-0ae3-451e-98ba-42f095a65d71", "sighting--da2db004-99b6-494c-8a3b-2945e31880a1", "sighting--4df880da-2085-44a5-9596-53c9d24bc2aa", "sighting--a6454189-45f5-4657-9523-b22139198300", "sighting--a10f9950-cba2-4f47-b60a-96e8f41440cb", "sighting--3ee3cfa9-de27-4866-9aaf-f56e480f5814", "sighting--d4714b59-266d-4dee-a950-0f6435a1c451", "sighting--92843c6d-de30-4aaa-99e4-86acaa7decb5", "sighting--93d54efc-3bbe-4b40-be59-8c5621b5955e", "sighting--e59ea9a1-baa6-4b16-a3c7-17c58b127ecc", "sighting--64f7f2ff-639c-4a85-8373-787b1c2f0877", "sighting--e22fd49a-c52f-4f03-a821-37246927aa1f", "sighting--d750e816-860d-43a1-a1a6-c379dff3c1e5", "sighting--64589735-b2c3-4416-96b8-48b139375276", "sighting--132bebd4-26d1-42ab-b123-4ccf27521645", "sighting--6b0f48e2-d01e-4d30-b6a8-04c04289e413", "sighting--9047a356-0c06-4111-b0ae-d54d7b740789", "sighting--3bed611e-389c-4304-b814-b47608435cf6", "sighting--71ef3548-8898-4ed2-9cdf-2a66decc5bee", "sighting--1af880aa-2fea-44f3-8ad5-f3c40be7c4dc", "sighting--4df8cb99-695e-466b-8f70-1947a131722c", "sighting--76fcb6ae-504e-4df1-9096-24132556d334", "sighting--46c89d16-d76f-40c3-8b68-55324b24a266", "sighting--876f992b-e6d6-493f-9f65-358eb98f93f1", "sighting--bb697fac-75ea-4231-91e1-ab4288cc12b6", "sighting--c6863af2-51ef-4ebd-8865-f1692e33ebe7", "sighting--49b6e3bd-ce69-4989-a3bc-5615e3db8654", "sighting--8ad6581f-f4cb-4aa9-ae0f-379b8e382573", "sighting--c2bb2c51-80d4-4445-88c8-b8ee80568781", "sighting--43ad2d90-5678-42f4-87b4-9b2d0ed7378a", "sighting--bc913a4f-18c4-413e-bd3d-ae56355abb70", "sighting--ff75ca09-81ed-4d99-b284-c70ea70765e8", "sighting--1081b423-04fc-47dc-bfe1-6631339f4179", "sighting--bf53c217-bfe8-4e91-ae31-ae98e651f019", "sighting--c1e67e0c-30c6-40ee-9c37-4e698dfd3dbb", "sighting--ec2e1425-6b42-4ef2-b16d-78c2e13e5eb3", "sighting--854f59ff-ffb6-4da6-8b09-e1df8ede9754", "sighting--26113531-7ab7-43c4-acaa-4cbb9f8eb85c", "sighting--736f6a62-63d0-49c2-9c33-8f4ef1f610ae", "sighting--b0527ede-59b4-4461-a08e-049820be7dde", "sighting--4859e985-035b-4fdd-9742-9f804eb4982c", "sighting--cfe8fbdb-f642-4760-80a7-22c413eb3fd2", "sighting--e4261389-f6a3-4954-b283-c062121f45bd", "sighting--d6b66e3c-d60f-43ab-9c34-adae883083ec", "sighting--0f6a6bd5-b6b4-4087-8efa-bd7de2489547", "sighting--a5c56b32-b1ea-4737-8e91-b79df087ebd7", "sighting--dae4d29f-93c2-4455-ae0c-eabbe82f2321", "sighting--23cf51b4-a55f-44b6-b0d1-297ef82df63e", "sighting--acb4487d-5ea2-4bc9-baa8-730a02bacc8a", "sighting--2534d615-5b3e-4548-8fa4-995f6adca58c", "sighting--501207b9-00f9-4857-831b-489be0cf8914", "sighting--5f7538ff-986e-4325-a1dd-124053f19687", "sighting--c889a0b6-1f60-401e-bd47-7a9e7ee65acf", "sighting--4da2d93a-3e62-4625-8bec-09fe3e5a3040", "sighting--cc477c56-f70d-4707-9a06-bab6caeb7213", "sighting--cf722fdf-0456-46bf-8ed9-282f34956f2c", "sighting--a3cd077b-0b91-4a41-b90e-616e70f738a8", "sighting--e2508af9-845c-4389-8715-518bec5865f6", "sighting--4c7955a4-eb13-403b-9d4b-b9e76870ddc0", "sighting--80ffe9a8-0623-458b-8146-e245da0a147c", "sighting--d01bed28-aa5a-423b-be77-015476d9b1cb", "sighting--6a0affc8-7299-418c-9585-391854d7c6af", "sighting--9183d545-31a8-45ea-ad43-a28c43f52fb0", "sighting--88757a55-bf0c-466f-8dab-1defc1df95e8", "sighting--4610bbe0-98be-42c9-b1ad-0b0999156bc7", "sighting--c800e28d-6384-4fb7-9f95-32c4392943ad", "sighting--db71ffa8-d50b-4dab-bc9c-a96ba33fe857", "sighting--4bbd244a-4a53-4160-8a15-e6eee8fd8382", "sighting--94a14729-d645-466e-bcc8-fb663137f026", "sighting--0f9017d4-c5f4-4514-8bbd-6b275437b358", "sighting--6f70cc40-8d9f-4563-b0a3-dc3427b97b9c", "sighting--629abc87-a4fe-443c-b142-d5a3fca84447", "sighting--ab69a09d-9818-42e3-942a-0ceaf1a45f38", "sighting--96b7c96d-4c92-48b9-bbc9-8fdd419cf537", "sighting--993cd2ea-4eaf-4a4b-af56-3c0493aebc18", "sighting--4abb6cf8-e5d5-4b17-a7cc-e4048af2e362", "sighting--8ccbf499-ca51-4d25-b153-bcf2592b1010", "sighting--afe6b397-f374-439f-8a95-8c0b5be01d70", "sighting--04d92dbe-98b2-40e0-9809-9d5654859274", "sighting--4cbe387e-7cd1-45c1-9f16-081de4932e86", "sighting--6e928e6f-f801-48b5-a0be-b74044d5c5b8", "sighting--fb7ec6ac-cc5a-4ed7-bc55-8bff794dff58", "sighting--8bb06d0f-7f1f-44c6-907a-f18a2e228a7c", "sighting--44e3a0d7-9c2e-4500-834d-f564c8728883", "sighting--1dfee183-090c-4f7c-90d8-fd1779d1bcca", "sighting--0182b94c-f22c-4e71-a3a3-0106b4c972c9", "sighting--97e16c88-fabf-4c59-9611-d881617d9b19", "sighting--43f57b7d-6629-480c-9a43-894657c66427", "sighting--ea0c1038-44f8-46f1-896e-f210f41199ff", "sighting--0631552a-852e-443e-8ad5-56dc1354a574", "sighting--1877def2-7ba3-4672-b4e4-02957f32638b", "sighting--e359f6a6-ab4e-49d2-b14b-b5cfbfe11d42", "sighting--e8a14628-691e-4d5b-8f2b-3e231abbaacb", "sighting--5721b4de-68f4-4bfa-8cfd-fb70c55f4a5e", "sighting--6af6f236-cbba-418b-8787-e4c0cb7d6da7", "sighting--7892b0da-32bb-4d8d-b201-841c5fb184f3", "sighting--6598a5cd-b39c-498e-b7cd-232e9a28e78b", "sighting--6bbd7be9-0cc1-4637-8d06-73326d85ad69", "sighting--c3a5f8bb-bc00-4f0f-859c-0cc24e59578f", "sighting--d41442e2-d255-41ae-9e05-f795e70cc1af", "sighting--62aea6e8-e679-41b2-a32e-dfe74d3ce1c2", "sighting--025148e1-0225-4e72-a67c-9a8c2fbae83a", "sighting--0937fab1-6178-44df-bee9-49927d4f297f", "sighting--1940f99a-28dd-4683-bdd1-ed8dc41d7b14", "sighting--48415733-d09a-4374-8f1c-283cc46d559c", "sighting--bf7fbc8f-9300-4733-b79e-6e3cfe3e5e43", "sighting--8e5bdb77-a276-4c7c-be58-03204e297898", "sighting--07d08afd-e14f-4614-a325-c38a0de28f18", "sighting--75dbaf10-3174-4061-9937-a31c76db7f01", "sighting--aa1ef58c-8707-4eae-9c1e-b95e0af34258", "sighting--5b8d401d-ad0b-4e28-8e51-00f6356ab3fa", "sighting--91f7a5db-a7b9-4467-ba30-92dd3813f12c", "sighting--b971c1f1-679a-44b6-8b9d-3c6782d2e816", "sighting--2c4b5fb1-65b5-493b-ad6c-a7afd0d95843", "sighting--16fe49e8-293d-4e8c-a72e-41e00b684f8f", "sighting--5409c832-d0cb-4f97-bc7c-950426d26921", "sighting--f630ed5b-7ec5-4af0-be92-c39a515d08d1", "sighting--d9345dcd-0332-49cc-8345-ed4e02b02eb2", "sighting--2fc9db5b-0fde-4b4c-8644-8b933f0291a7", "sighting--9edffe08-0e40-4bde-8bc4-f6780051efbc", "sighting--d2837228-f711-4d6c-b62c-5b32fff9b21f", "sighting--815fc03f-c233-4776-83e4-7ec443665b8d", "sighting--bdee6956-8e09-4249-b5a3-bdeee61d9614", "sighting--358c0a6f-7c34-4e72-9d4a-413291f47600", "sighting--447439df-e268-4e44-aafd-8fd5a792dd4d", "sighting--fce8897c-b6c8-42d7-8db5-55a5d12fa8bd", "sighting--cd3d5771-dcde-4a3f-a75e-962cf8f10b51", "sighting--8fca6595-5a65-49dc-aca2-7a61deef2d2c", "sighting--531e25d8-2422-4596-acdb-026c4d45ee2e", "sighting--be15e293-b405-4834-a137-88c6309ac29b", "sighting--5b5f65ea-9762-49c4-bff1-e4fd448a97dc", "sighting--017bd404-3e40-41e7-bc88-4a463176c691", "sighting--fa826a79-cad1-49da-b639-71471bb41b53", "sighting--f0f06301-3f57-48a1-8411-06a43cebbc9b", "sighting--ea21bd39-4bc5-4ad3-ba19-48deb276b794", "sighting--068879a8-7b68-4524-b129-d933f67b7e55", "sighting--8a7e9344-e7b3-40d1-8018-4fe32c262025", "sighting--6602c17e-9dd0-4133-8fbf-60af7ea8681b", "sighting--917ef69c-746c-4820-b212-123f28fdb3a9", "sighting--964cdf7d-e808-4cd6-9fdd-b1dc4401ad61", "sighting--235f4854-52e2-4836-b55f-34af769f0733", "sighting--f9e88483-8c86-4d8a-8887-6bee2508ec17", "sighting--f3208820-4e7e-4643-964d-a0cf5ac06054", "sighting--281a2342-86d0-483c-8a99-7d3748f4ff9c", "sighting--de85b304-5f24-4f71-b67d-84cefddb0584", "sighting--d07604dd-ab72-4171-b32b-06ef38cfd1c4", "sighting--63e77990-9faf-4468-b2a5-2310f2a6bb5d", "sighting--ce5fad6d-1d5d-4ca5-b169-6758ef7a0c6b", "sighting--9a0858e0-4b70-4e7b-afad-fc1bb52c6bb2", "sighting--ccf72fdc-787a-4952-9cab-c2f497319ea3", "sighting--cd016dea-a85c-4b5d-9beb-2e8888319ff5", "sighting--4402f560-ea9e-4224-aa7f-1098ea7e19d2", "sighting--332a78b9-62c0-4b8b-a132-3389d803c769", "sighting--d9795774-cbc3-4533-91cc-18a0f34f09af", "sighting--1c73bedf-d045-4251-91e5-4bf1ec0610a3", "sighting--b274bae6-476c-40a9-ab30-57e110160289", "sighting--da0fd837-9080-42d2-a3e0-b2834b038d2d", "sighting--bee7b765-7abc-4dd6-9a18-e6e9256de3f9", "sighting--8a631dfc-5fa1-4d9b-b915-1964f3b3a951", "sighting--d0759a49-1d60-47ac-aabf-aa4caaea8e51", "sighting--65bd447d-8d12-43bc-82c6-bc70bf1aea6c", "sighting--90109dfe-7e3b-408e-b399-3089fbaed3a5", "sighting--ee445f0a-8c29-4a0d-ad94-191cc4592955", "sighting--e044b503-f37f-47b9-9c65-982f579445f0", "sighting--fecaee07-1558-4b3c-ab16-a4bb00784fbd", "sighting--41f92f09-ab85-4da1-8caa-64af279a0667", "sighting--25b1b8b3-0644-446f-8617-b2fed4939569", "sighting--e60273f1-c300-4b97-9ab3-1dc4ad47cf5b", "sighting--032fe8e2-ed4d-4100-8b9b-711793b2b850", "sighting--e91262f2-694d-41a9-821b-bdd0d1d42d51", "sighting--d3fde94f-e7b5-495b-9185-aad4d5cdd245", "sighting--aa22495c-90da-4244-b848-e23cbde11a70", "sighting--19e63426-20d0-4a13-a02c-1945409199ec", "sighting--29c13c07-d682-485c-9956-42cd7d629564", "sighting--492a332a-fecf-4fde-8138-514f0f842d5b", "sighting--b9abde2f-e81f-4e2c-a6e4-baf75385e0f9", "sighting--e27589e8-0be8-4687-b889-a5e1090615ea", "sighting--79d161d4-5795-47f3-9bba-515b0854a100", "sighting--f4bc5f77-51a3-456e-9edf-c20d04f2b218", "sighting--ac2178ca-856c-41ac-879d-8d1a7c4b84d1", "sighting--8abfa2d1-0d22-4e4f-aa80-375e0371c904", "sighting--6000d5d5-8ce8-46d6-858e-399bba4101c0", "sighting--48db074f-078b-4e73-b2bb-c31c4bf2d25a", "sighting--fadad091-23eb-4195-b7a9-f637429a5c49", "sighting--9a6d6d12-dbd5-48fb-a7ba-c5030d16a4a2", "sighting--a180cd55-32eb-4ec7-b35f-39575a05fd0c", "sighting--a30e87dc-6709-48ef-8c4d-9516ad2d020d", "sighting--06a2d964-df9d-4682-9df0-568f2736bdfa", "sighting--600a2fcb-6a45-4567-98cb-eb2da48d4edf", "sighting--69c81ec7-3323-4b2d-9ecc-d9ab697c5f6d", "sighting--1be1ad8d-56a8-43a8-804f-2a08df6721de", "sighting--01f8b7de-1f0b-427b-a3a5-5b1036734241", "sighting--197bf645-224f-448a-9a7d-9a0553b13ef8", "sighting--d786cf67-99ff-466b-8235-c278e1e69fc4", "sighting--bb2645b0-77f5-4871-bb18-95ab4b9153a8", "sighting--026b9814-5ed1-4656-8c1c-2f144d506749", "sighting--7e4703e1-4c16-40fc-a0ab-03ec56294615", "sighting--bb12c595-4656-457b-896a-47acccee76b2", "sighting--15d50731-a296-473b-9b86-5e02ae509a6c", "sighting--446d7a73-d79c-4f2f-a14c-8a134fb68ebb", "sighting--1d467119-abd2-4625-b8f5-b9c4edae395e", "sighting--c1f6e9c0-7d74-4bcc-adb6-9b5a669ef248", "sighting--008a3adb-6cf7-455d-87c2-878a75a8ef73", "sighting--e21f5550-d212-49d5-93f9-8a832e8f79ed", "sighting--7fa51176-5c34-43b2-80d0-9e970604199d", "sighting--b0dabd95-5245-4385-a1ca-5f66aa4cd150", "sighting--4686d4fc-c8f5-413e-b8cb-7b80b2f1364f", "sighting--0e8102cf-43ac-420c-8e85-1d3600d892d0", "sighting--4c8f9d5c-aed0-451b-8b63-dd00dac14a9e", "sighting--a1a142a6-0cf4-45ae-8483-0734d03249ee", "sighting--903eb4cf-bb64-4b22-9e56-d1efe07fa9f1", "sighting--70f7a73f-e93b-4e03-8709-f5e77f1eacde", "sighting--a2cb1253-b11b-4912-b798-6061d626bbaf", "sighting--f86ed6cf-395b-47b0-a408-c8654f080681", "sighting--faaef756-98aa-4b4f-8e81-978cbd4474ff", "sighting--f24f9d79-de33-41f9-ac34-1f59e8888e12", "sighting--434806f3-3398-4738-b35c-8dab84488168", "sighting--670d9d11-ee8e-405e-8d6a-ea763f404e95", "sighting--3f51e296-55b1-4605-b27b-4b33ac6e9422", "sighting--13a35242-6a08-4a2e-8c10-9ad5439b3db0", "sighting--9d860c07-268c-483b-accc-1caa5639c08b", "sighting--31880322-4576-4d32-abf8-8212c4ee969d", "sighting--960ce5f1-e2e4-4729-be5d-ff9c22dc7cec", "sighting--29ace9c8-ea2b-4dc0-b0a6-3ca6b5570dfb", "sighting--2167ca4c-6b8e-40ef-9fb0-cd031aa55cdc", "sighting--7d2bb937-a813-4471-967a-9c6439cbbcfa", "sighting--2869cb1e-d622-41bf-bac3-3295d05ab653", "sighting--ba90546b-2a8c-4332-8914-78d86c3a42ff", "sighting--bd6bcc14-001f-4247-a267-73d685cbeced", "sighting--582b08fa-fc49-4306-af95-97705d5f728f", "sighting--298a94f0-02cd-41f8-ae9f-c0040a2478d0", "sighting--7234d3b9-c69f-43df-a6ec-c998a2fe9fd4", "sighting--2a541a36-9f57-405a-a1b0-c337a8203abd", "sighting--8ce1b203-50dd-4df0-91a8-8738ca64e1b2", "sighting--bf9c1b01-a7d9-4f71-a17a-6f1a3cd7c72f", "sighting--f502c956-260d-4849-9582-d169fa1ee3a0", "sighting--d743b0f1-4eb8-4a9e-9d6c-f9811edfb41d", "sighting--b35c7f2c-c3c5-4383-bc53-b2a76e2a6450", "sighting--9b49f93c-77f4-4e20-83c7-a62cdeac1b3b", "sighting--f3c3f438-000f-4fd2-9f84-4e2d961e7fcc", "sighting--4fa970b1-b877-4f62-8f7c-f03dedf34019", "sighting--801d2026-553d-4a11-aa6b-caecdf149b72", "sighting--226427c6-57f4-4e0f-8c65-0289b01735c5", "sighting--0a52a766-6de9-4dd5-ad3c-656aaa79d131", "sighting--f00e21f6-b48d-4f24-b53d-4ad8b764f9a5", "sighting--b6c55f01-6e86-4458-9517-ec944aa2f6e0", "sighting--a0eaa903-3ad9-4118-8a7a-30b7049c99c4", "sighting--96d63e9d-af2f-464a-8484-3806cbd8b633", "sighting--996f880b-6479-4406-9e68-4ba099f404a0", "sighting--cf9a4ce2-d2b0-4aeb-8161-50ad65a8d2f5", "sighting--553d9ada-467e-4461-91fc-e6e49c7fa8d9", "sighting--80c6ca97-c6be-4223-8608-3c3cfd36e8b0", "sighting--9bfdf165-71c0-4426-b39b-eba71394cc52", "sighting--fa0c61b7-4253-4a26-ae5d-203343435575", "sighting--109ca943-b783-4936-a25b-fa4762a24141", "sighting--06263239-5a28-4aa2-8443-f59ffe0484d4", "sighting--3367baec-f806-4d02-bc6c-b2f92dbfb7d9", "sighting--64f5f28e-84be-457f-9b98-4d8e558cc7d2", "sighting--d2e1582b-0f19-4780-8176-5b2ef448952c", "sighting--8ca81013-7fba-4e79-995f-a0f5fcff0d44", "sighting--36b1b951-259a-49f3-b7da-48fd7ff5fd1c", "sighting--ab6235e0-3ea5-4db9-be48-556f1667db20", "sighting--051d4085-fdd0-4ed2-9776-788c4a2da8eb", "sighting--be31fd07-4e2e-433b-8d9a-c78ce41e0f61", "sighting--7b7b99de-0ea7-41fa-9674-737e6a6c0504", "sighting--70c7b63a-38e9-4e91-9509-5cc024cf733a", "sighting--f59c15d9-88e6-4cdc-8e00-ed12cda8fde8", "sighting--5062bb7b-ed8a-4aca-8f9b-2f903d8c4ec3", "sighting--bc76f908-ac82-4d13-ab45-ddb9511a6309", "sighting--0d6cb732-deaf-4a42-8e29-ae1b1e8de279", "sighting--c93f416d-4180-43bc-9697-027f523979f4", "sighting--7540c278-30b3-43dc-98b2-0bdb4029af36", "sighting--0a8d0622-b8ee-405d-bdf0-a12cdb1c0434", "sighting--463ac36c-3555-4181-acdc-33b99ef40757", "sighting--5908c9ea-5835-430d-8342-b58ca1631ec5", "sighting--af72e8f9-9400-43d6-bb47-2095cd8c8b07", "sighting--2c33f0ad-5858-4461-8bae-ef03165f8e26", "sighting--55a9e734-5fb4-4efa-8caa-22f4509752fb", "sighting--90869e86-ab6a-4303-86f4-2ce0205ada99", "sighting--a1e983f7-f765-4051-97ff-ad927322cdfc", "sighting--60f14b9b-1fa7-4a91-ac47-db2c11f61aa1", "sighting--d0969a2a-9298-402a-a7e9-93217fb176c4", "sighting--ddcab812-28a2-4c91-b338-2158b0f5a687", "sighting--c78c2164-8aec-47a1-a9bc-d32bdbf35fd2", "sighting--da221710-fc03-4614-a079-b3c3a30c96d9", "sighting--fd30351f-bce4-4709-bb49-efb94f92772f", "sighting--0b551ed1-6c9e-48ca-90c7-03080baec209", "sighting--852494af-05ad-4c2d-b55c-455802b22d89", "sighting--ff19298e-28d3-4569-8b9c-1e38cfc0fb1d", "sighting--dff35f24-2d3c-4d35-a372-3bbd364420b8", "sighting--94e47dbc-f444-458a-873c-a6e3e02ca0e6", "sighting--8b41fd85-a212-44e6-92c5-5d33cde11e94", "sighting--83a3c3b6-f943-4879-874a-79c93400b52b", "sighting--5d7bb0e8-cb37-402e-893d-c2c264f51890", "sighting--eaef8dea-188d-4012-83d5-b75d80300690", "sighting--71aa97aa-42c8-4251-ab70-99f39db454ed", "sighting--40796960-e0c9-4bde-ac67-920490f9d075", "sighting--d3cc8e42-49e5-40b1-bbc2-7049c2d0bda1", "sighting--b69a504b-be13-4889-9fbe-9622c2c00873", "sighting--5b568111-9bdb-40ee-865f-3848fa5ac0d1", "sighting--dfcc99c6-9bbc-42ae-9a9b-834048ea2a96", "sighting--73cb01b3-97d5-4d53-88c2-6b4437f8ca6f", "sighting--6c5f5a87-1b57-4032-b4a6-557c58555306", "sighting--a6467b7f-27c5-497c-8ab3-7365623750cf", "sighting--d8f35e93-6a14-4e35-8aed-d474b05e21f6", "sighting--81dbe469-0fbb-4e74-80b6-a2f02ac5167a", "sighting--0e5b5707-fcad-4337-9f41-52a6fa43a599", "sighting--a3bcba13-79a4-42ca-87b5-258fcc65d407", "sighting--07475555-764b-436f-a7fc-9c3a549ab959", "sighting--b49d4296-1cf9-4757-82d6-ee076d05da15", "sighting--d1a4ae13-b143-4fe0-8343-357b60d810f8", "sighting--4148b27b-a287-4442-a28c-ab8651e192d8", "sighting--9845c9cd-06a8-478f-a4ed-6464a61a62c8", "sighting--55dfa3d5-7c65-4f39-93bf-b131b06d0ff3", "sighting--951fdbff-1f15-441e-972b-b55778ceacc8", "sighting--a04799d2-3a7d-4a88-8747-5e235c26740d", "sighting--1b09e2f8-1a39-4846-9773-2520c32e4df2", "sighting--e1773de3-ffed-4c8b-8a5d-e46b70d0f40a", "sighting--f388f61d-0a31-4324-a02e-4796c998c8ba", "sighting--66005e63-f416-4d7f-9bc5-c73236050fc6", "sighting--2258d82b-6928-4aee-8837-cf069eb5bdb9", "sighting--436bef22-338d-4722-8b6d-ab6dbed1abfb", "sighting--20446411-6726-4ff5-a933-45c7ff894f17", "sighting--f9d28cb6-3001-472f-a941-ff2341265131", "sighting--88dc80c8-096d-4e56-b28b-e5bb5890cb97", "sighting--51b19e1e-e700-485b-b46e-c717fcdede9d", "sighting--19c35ba9-9dfa-4026-8d90-492aea323849", "sighting--cc9e7c4b-4aac-43aa-bc63-473060a3fa77", "sighting--13565aeb-c334-4f1a-8408-790ac6ba30a6", "sighting--fed53b9e-7e70-4433-bfe9-c67920afa4dd", "sighting--74092b55-6f88-484f-81de-4591b952688f", "sighting--a05a80f4-cf4a-41ba-b3d9-fd7c0577efa9", "sighting--1b51cd25-1716-4445-a024-a934a86314b9", "sighting--1ba8e0a9-8163-477c-bbfd-67faf677283f", "sighting--581bd631-aa70-4598-a313-ed5b92c08a95", "sighting--845d4e39-ebe3-41e3-afd6-71c0d8aea600", "sighting--8492e6ab-493c-47ec-a8f6-cd315e61a08d", "sighting--f602b26c-c196-4e2f-af02-b0c6027c1392", "sighting--e207f027-43f8-455e-aa3a-9ab33672248c", "sighting--c4790e4a-5093-465a-9675-daa08a828bee", "sighting--bed31815-298a-4f5d-bf03-8bbfc92344f2", "sighting--297934c8-26f5-48a9-ba8f-0c05eb81e49a", "sighting--e829655b-89b1-4a1f-abc9-c026d537f750", "sighting--ce8c46a2-5b05-492e-8aaa-fcfada71a9f2", "sighting--b40911a7-f618-4e96-8175-c81f4c88e4c3", "sighting--c7f1ca99-8938-45ed-827a-a4a4a008d4b6", "sighting--1b19bc6e-7261-4e6f-b4a4-d34e929d7d5a", "sighting--43f1d381-8657-4fe8-b7e9-f88a8f1cad51", "sighting--3fcadf9e-b27b-42f4-b3c5-9dbfadcecae2", "sighting--691dd83f-53c6-4e46-b8ef-6470e5d9c1ff", "sighting--d195e4f7-1c84-4b0d-89aa-632660f6eba5", "sighting--f81bb6cb-e5c8-4eab-a932-e4a141c5180a", "sighting--16021333-fdf8-4ff0-b288-17f860c2385f", "sighting--6bf76cc9-d933-421f-b2f9-3bb96368844b", "sighting--d670441c-1249-4b47-9c88-daac73dd46e3", "sighting--0d95777b-65a2-40c8-a46b-336ef9ced6f4", "sighting--b5c40bbd-73cc-4685-bc86-98b0d592542c", "sighting--5c69cc90-68c1-49d1-ae57-df5f23d2ec9d", "sighting--1cf1981a-5468-4098-b819-bcc94ea4fc11", "sighting--9d54c8a6-b706-477d-ae92-d1d57b54eea1", "sighting--e1f62030-1761-47b8-93d4-0177b6101a46", "sighting--7e5c851f-6077-4e06-a33d-f90b9444bb8c", "sighting--4171af9a-301f-4138-a99d-8d94f49d0fe3", "sighting--049113e6-1f10-4e14-9dc5-4b7fef5b30ac", "sighting--64185ff7-5e46-4fd8-b77f-e5a3c5a5a38a", "sighting--793bf096-63a3-4138-911a-d8440f7f028b", "sighting--2455c99f-be30-42f9-8c9f-fbeb291ccde6", "sighting--067203a8-79ed-4374-8cc8-9153964ad91a", "sighting--41b8d45f-85e9-4e73-a4c2-d5c839301a2a", "sighting--c47abbe0-6ab4-4788-9a60-4b81550c887d", "sighting--c84fd29a-f18f-4195-ac38-7b72050478ad", "sighting--2531b292-11b1-4051-b0c6-982117cbd054", "sighting--f188da5d-ccde-438e-9031-5b9f5ad06ec2", "sighting--3783ae74-a555-4dc3-819a-664726ce1067", "sighting--d8f05ba8-67fc-4f99-be61-94e63d386829", "sighting--c795e911-ff21-467a-af00-1aad08d0b592", "sighting--9295866a-14ae-4c70-a351-d8c2d9745fbd", "sighting--71231d54-3cc6-4bf6-8687-19486ab85a80", "sighting--3f16451f-5488-49a0-ab5e-5a52cc9482f9", "sighting--d78a4a00-555b-4564-a75b-9c20b8a91fb4", "sighting--46ad2c34-8e78-4f07-bf2b-c29ce028a31e", "sighting--b657e573-3679-41ff-8f78-83d455109224", "sighting--b9736822-3bde-48ca-a971-ed6e129f8d8e", "sighting--b291994d-bee7-4c6c-9481-5f689fcb6703", "sighting--cfe755fa-5cc3-4306-910a-45e6ce514168", "sighting--5745231a-8f05-4ac2-a1df-2d3a13c6806f", "sighting--1b4b6d09-7205-49b0-8605-80df50460fc9", "sighting--6ed6468f-0b16-442d-8714-56e6eee96de8", "sighting--d74d2027-fdb9-4b82-8c63-9e8559b0a0fc", "sighting--217fe7b5-be86-4114-aa9f-a89e51062632", "sighting--c5f2f43a-5f85-4528-b1a4-4222494b51e7", "sighting--acdcd1d2-b021-418e-9b05-4df67ba43c09", "sighting--ba615863-b176-4a08-ac59-627d99d467e8", "sighting--274753c1-72df-4276-b8cf-ae807e5559af", "sighting--a2b175de-1ba2-45c4-b5bf-ac2d5bfdb165", "sighting--7a6da469-ef08-40e7-a674-d5b3af40197a", "sighting--31e1fc48-18f0-4cd0-a516-a5c236476541", "sighting--275247fd-6bfd-4ef2-9676-8051acc8c15c", "sighting--8fd6d9df-c578-4a7f-909a-8cd7ab7a5032", "sighting--c9fcd992-d348-4997-bd2b-ff1d6bbe1762", "sighting--cecba769-1ba8-4225-9ac2-1e1a91e0cf94", "sighting--1b51e4fb-ad4a-48da-9172-defcfb8b9a40", "sighting--6ef399ef-582c-45a0-9c1b-8bee222a9217", "sighting--90e11041-09d0-4351-98c1-3182e82af2c7", "sighting--a6f69e27-f230-424a-b03d-bf41af9f1a08", "sighting--f3625ce0-3a62-43e9-9e41-3ff89e52fc5e", "sighting--e533da6a-b827-48a1-9d29-5633c23b1fd2", "sighting--ec10c571-14c2-47a1-beab-9efd4bdaf368", "sighting--8a7c0abc-7b27-481f-a443-306339d4137e", "sighting--a16d8804-2d0b-4e2f-8d10-d6dc98234e05", "sighting--ce91739b-cab7-42ef-850c-37ecaca73849", "sighting--ffda4b45-ad4f-4108-b3b3-2fd106d73111", "sighting--a76522a9-ba6c-4ad7-8288-ac8b849ef65d", "sighting--bf747de4-8d3e-4d09-82ee-e0a8b8f2b94d", "sighting--d2ceacf7-8293-462a-9465-fd21ef7a2ea5", "sighting--2addfbbe-9abc-4a63-833a-52b080015cfa", "sighting--2eb3894c-869b-4e02-bc3f-95845ee29acd", "sighting--c8c66867-4b82-485e-955d-e2a1936f6a0c", "sighting--bf6fbd19-12b7-4ad0-b012-3de4a5f73556", "sighting--c34a78af-f74e-4c9f-9253-ba0a7f5e35e4", "sighting--099839b3-4d35-487c-9809-6aaf3c7f9029", "sighting--525d62f5-2010-42be-bf59-88fc8d1bf247", "sighting--325416aa-a282-489e-9dfe-9b1eb40279df", "sighting--d5647a17-0b32-4b1b-af46-08539a29ed0e", "sighting--bf3bf42d-222f-4afb-95a7-23ca6cd7cbd9", "sighting--8fb541cc-9c73-4aed-8d00-ca6eb2d09c48", "sighting--6b64dafb-a9b7-4d09-9577-9555cbfd0a63", "sighting--bf9ab611-579d-43fd-ab22-1021d29a1cbc", "sighting--e436c964-c293-4788-a193-faf62ace19ac", "sighting--32abfd08-498c-4832-8d45-71b49200dc94", "sighting--c8e0de51-6198-4b1c-a26f-11d6a89c966d", "sighting--32837c22-6998-4a01-b2e6-dcb4106bfcb8", "sighting--7dd2af05-f0f0-4daa-bdc8-c4f10d7e05a0", "sighting--bada466b-bec7-49e1-8df3-f30ec4c40666", "sighting--735f84aa-6ee7-42a8-bd47-0f27975c9ebb", "sighting--fd434a01-1370-40e4-b616-248e37bf8862", "sighting--03f3ad8b-56a4-4f1f-a2ba-7bf7e186e76a", "sighting--d81d0809-9b21-493a-8fb4-e62062ce6d9f", "sighting--4c5ba450-1210-4fc9-8839-2582e280e009", "sighting--c9877df5-1f6c-4335-adbc-ab237b85acdc", "sighting--ee460646-b575-4a9b-9b31-f58bda93972d", "sighting--1d3b8d2b-6de4-48bc-983a-2ee18661430f", "sighting--2efba60d-6135-4e1d-b4d1-de74702c022c", "sighting--25108526-dc40-4dfa-9531-5498164b492f", "sighting--b8582be7-ecf5-40a0-9b46-20a01ce959e8", "sighting--e28ab3f6-0937-486e-ac47-298499520b93", "sighting--de9af310-f659-4152-99fe-04469ed9e2ca", "sighting--544dab60-43f9-4a4b-baec-88dadfad4148", "sighting--a846aecc-327d-409e-bd24-e9478882321d", "sighting--4f622cc3-d95c-4b26-96a1-fd134bc1d6f6", "sighting--7a4ab7fe-3246-4ffe-8949-4d4517375c4d", "sighting--8ef7131c-0b5b-44a8-9ded-a3b722ab217d", "sighting--0ee291e9-19dc-45cd-a2e6-b63eb3703fba", "sighting--081769a6-7b1f-46de-8eef-68f713a76b92", "sighting--1416c169-3c27-4fa9-bf8e-1dd3f7fe1ad5", "sighting--cb58e014-bdbc-4221-9252-d95e257b3802", "sighting--2ea0c852-4ad1-4f0c-9c1c-f8b0162a6e9e", "sighting--8094208a-919e-44ec-aa5e-7fa68d569805", "sighting--17fcfa81-2e01-4a3c-b983-27a4eb7a5ac4", "sighting--48693600-8395-4de0-a464-e0c340ae11bb", "sighting--7f83f3c2-0110-49b7-80c6-3dd39a662067", "sighting--4060ac5b-8713-4512-956f-0fb988ae8670", "sighting--39cabf37-9115-4399-9788-346c239ac402", "sighting--0885822c-a0d7-4b47-bbab-ffa1d9d627d9", "sighting--915b9102-4779-43dc-ac72-9619c2e1130d", "sighting--b0f30bc7-cf55-4d4e-968a-6e9d0b6fa177", "sighting--6e2ff507-b521-47b0-bbba-e4a6f266fd23", "sighting--43f11565-5505-42ec-99ef-0e717a8cd62d", "sighting--5fcd7bb4-6567-41f6-bec8-73964594e03a", "sighting--2c367510-c2ff-4cfe-bd4c-9849b04eecb5", "sighting--37f1ef2e-9589-48b9-8952-61f36a5bcbbb", "sighting--8be0243f-ba79-43d5-a86a-c39d0de65724", "sighting--a444f5ea-c6ea-4fd7-b6b2-c3b17a0ba1e2", "sighting--8f66a0e4-cc9f-40af-ae3f-52df5d187fc5", "sighting--97874e43-1a60-4654-95df-2874ad1b3469", "sighting--301c4f00-9503-4b1a-80cb-a8165185196c", "sighting--8f4b4ad8-c5d8-43e0-ba0c-0e6598e53535", "sighting--80f0465f-83fa-470d-92f8-b1470bb6ae7a", "sighting--32eb37a6-845a-4f63-85a8-54cedba230e3", "sighting--0d4d7f51-83cf-4d86-ac51-628b56c729dd", "sighting--6e5e3d3a-0908-4072-9d6c-bc850fce3c24", "sighting--74050856-3685-4b4f-9bf9-27f14d1b9fec", "sighting--0b29cf89-550b-45b8-bf1c-754f7211e375", "sighting--437c02ec-0bbf-457b-9925-7c2a6bd34ea1", "sighting--cbce8f39-44b9-46f4-aad6-93707408d327", "sighting--c030a1dd-973b-487f-99a6-de009a703b35", "sighting--30be552d-d524-4465-aa14-513b991a980b", "sighting--374191ec-8b9d-4316-9aa1-122f8088694e", "sighting--14bc7d50-7569-4d78-8b46-b5912ff431fd", "sighting--5c29258b-f71a-463c-a8f5-1d6896df9a88", "sighting--e9f7f0bd-f3bd-4e61-aff4-34eeb8c7c041", "sighting--af93127a-4ebd-4c38-a73a-aef73db61a2b", "sighting--6c2210d1-13ca-4615-ade0-05282d02acbc", "sighting--e114f0bc-37d9-454a-9678-2aa1b6690d34", "sighting--238b6493-ce5e-4652-9f0b-869c0c0aaa8c", "sighting--bf807624-66e1-45f6-99d6-b27654fa6419", "sighting--331540ca-b361-4065-a1e3-74717a8d1671", "sighting--487ea2c9-b766-4d40-bef1-298ec4d3c8ce", "sighting--acb2637d-dc56-4c34-b0dd-f2143330d333", "sighting--d8c967e1-4278-491b-87ac-f242d8010ec4", "sighting--971b1630-259c-42c7-8744-1b29cae02e3b", "sighting--414efa61-96e7-4710-be9f-9b1fd0bbd9eb", "sighting--46a9d31b-e66b-4791-bcc6-48059e7f38be", "sighting--dfc221ac-7457-472f-a258-0eb52b5ab397", "sighting--5d8fcb5f-8f39-4124-a509-271c170be2ff", "sighting--b2884975-1ee1-4496-aa86-957566beb449", "sighting--65240c22-f86c-4793-8464-41075f7305eb", "sighting--45d7896f-e94a-4726-a35c-ce63e5da2ea8", "sighting--0e3279b5-52e0-487d-b796-2644e1bbba45", "sighting--101813f1-a8b0-42a4-94a1-ed51ce00f0f8", "sighting--98225d98-4736-4230-9332-02fd838f9997", "sighting--0343ef73-818f-4495-aaec-78d4c31c3d0c", "sighting--ddd54b93-2cf9-4755-9bc8-71a9500da83a", "sighting--7044dc4b-2b88-4742-9f50-686aa86054f7", "sighting--cb0c0ae8-6486-4ac4-a9a8-e327909d7617", "sighting--6e52e39d-1c62-4d04-90e6-bb98934a8e4a", "sighting--fe7131f4-b8c9-44ec-b63b-427f59e4a299", "sighting--8227d6fd-a1ca-4564-bc05-6e031d8d469f", "sighting--c81a2028-edba-475a-b6b2-615c4d606aad", "sighting--dfa56a37-3ddf-4492-81cd-5cf73b9adeb5", "sighting--9100725c-c6b9-49c2-9e52-bcf767ed151f", "sighting--4ab6eb12-5b32-4a85-9a9a-aff522787bd0", "sighting--c531e374-c038-4a7d-b7f2-e35650885a88", "sighting--7312958d-4116-468b-8565-3486caec8c36", "sighting--5705b2f2-20c7-4264-ba3b-5b6cd986b878", "sighting--05e3dcc6-3f46-469b-9dbb-623d5fccf984", "sighting--843a27e8-33e5-4948-a8f6-08aafb36dcbc", "sighting--ccd65d48-a1da-4dba-9061-94230f992779", "sighting--81469296-88fd-4493-b45c-4b22762b216d", "sighting--a0f34a51-f0d0-43f1-9908-e1de21ecc124", "sighting--6917dcae-06ac-4d1e-83d7-482eafc6df4a", "sighting--e5f38389-281d-4fd8-8c9a-b7946a4ebf03", "sighting--e32542a3-6c87-4493-aed1-fa9e21746ea4", "sighting--e548fbf1-eba2-40d9-af4f-4e0f95be1e22", "sighting--a0e0009c-4b4c-427a-a6ca-a4ce8c131bd8", "sighting--68618e23-7c83-468f-9f61-0e49773847e8", "sighting--dddc69dc-2159-43fa-9b46-1a2df02ccfce", "sighting--e508ec83-5f8d-4129-99ab-0346434b571b", "sighting--44c5ce53-c904-49ab-939f-cb763add0e02", "sighting--4d8f5d52-9c18-4965-80ab-83a42104926d", "sighting--b948ae52-7a5a-4a5d-ace5-7659b0aac19b", "sighting--a81cb2f8-0963-4e10-82c2-f1b22149cab0", "sighting--c3324db1-af50-4c2e-a96c-dbc07cfdbc54", "sighting--22bcc4d6-1d45-4894-8374-84067dfead26", "sighting--7c016cf3-f1e9-4c27-940b-df74f77c0c01", "sighting--d360806c-e1ca-45db-87ae-d5611346eeca", "sighting--0bbcd7fc-c490-40f4-ad5d-ef3340f335d6", "sighting--7877eaf8-c10f-43a9-b821-cd49e4cab5ed", "sighting--b53f546d-9fc0-4f7b-a509-9ac5016907c0", "sighting--8202fbb8-d815-4486-a6f1-abf7b9aade65", "sighting--8182ab08-4f12-4081-944b-3035201231e8", "sighting--1c3361c4-7b3b-4e3b-bd83-f7c2f826dbf6", "sighting--0d853508-6a7c-4090-8373-9f3b382cbf51", "sighting--4df474a6-125a-40f8-8790-1059833fb3ac", "sighting--9b1ecd4f-2960-49fe-8f06-4c4881181f85", "sighting--98f94b83-67b0-4eb2-b3da-025f14af0cdb", "sighting--7d31a07c-7f42-483b-8fc9-cabc40b9d3ab", "sighting--749beed9-4fe8-44fb-9032-92a05a125857", "sighting--3d29334d-960c-4b86-9416-543b788b7cd3", "sighting--4a194a6f-ad7c-418a-a3d3-34aa9d325618", "sighting--647272d1-a379-4df9-9a91-4ea966b040e7", "sighting--8db8f070-0ef2-436c-a3bf-0be890371443", "sighting--91b140de-5e7e-4cf4-a404-7f9a749a90d1", "sighting--636b7df1-2e4a-4529-b3e5-eae4d1fd3711", "sighting--ad240d50-162c-4b6d-a4b3-b7158ce5c7a0", "sighting--519c1afc-77ab-4ec1-bacb-fd95794d5e14", "sighting--e45798fb-1557-4c6e-a141-8c71857bff32", "sighting--92eb1686-f015-479a-93c6-e8a681f1c389", "sighting--47e1e7fa-11a0-44b9-b1fe-246c85422599", "sighting--e8a5f476-6c5e-4511-aa6f-1f184c32ce15", "sighting--febd2953-9d5f-489f-835b-628444dbf3cd", "sighting--9bea5bfa-a9a4-4d87-8c66-dc0e083d8873", "sighting--0b238197-1087-4603-af02-37ad927ab937", "sighting--343819f8-42ca-44cf-95b7-311a5e65e891", "sighting--60c26c23-0bd5-4c20-a7d1-d1cecf11c5d0", "sighting--f75e6032-5ba2-43f8-881b-109cf0a8d352", "sighting--8d218f27-9b94-4fbd-818a-03170fa26b30", "sighting--9683d6a6-8875-4d17-bb7d-d0fad86db8ec", "sighting--2af1955b-f69b-4de1-b96c-15583580106a", "sighting--37430ed2-7ecd-40c9-95c7-3c79c780086f", "sighting--d06ff231-dc51-4cec-a336-81957f639ad5", "sighting--d52310df-3e37-4822-8ac0-bc752dc0556b", "sighting--227c9a08-baf4-4036-ba14-375714251815", "sighting--4ff2170b-59c9-4a06-bf47-d98d7899975a", "sighting--8de698dc-53b2-4aa5-98fe-0fbca96d918e", "sighting--b023f5b1-4b4a-4007-bdbe-8a5158f158d7", "sighting--c8bab2bf-9eac-434a-bf0c-ded56278dbf9", "sighting--da7ebd0c-40f9-4537-8623-694f1ed71ff0", "sighting--bfac0998-da77-4c9d-830c-0b99119483df", "sighting--96879b02-3ac3-4aba-a396-7f330fec92f6", "sighting--2454e15e-a91e-4112-8945-685c493e95c7", "sighting--0f36724a-a8c8-4964-971c-0c6026a6e1cb", "sighting--6a4d85c0-96cc-425c-853a-4ee5f316d0de", "sighting--b67cbe20-e54f-4ac0-853c-af49d70e309c", "sighting--5d6c6ed0-a4f1-4d04-8ef0-c6a72ad82c19", "sighting--fd4c21b8-55b3-4d70-ad43-a47102b86dbc", "sighting--a4bc011d-2539-4088-8db8-44595f0a0b44", "sighting--56acfd7e-9ac5-446b-ab99-820a76a08340", "sighting--0c064e26-4c60-40fc-b290-ccd2f5916038", "sighting--9c8045b2-05b9-4ac8-8539-b98785cc0155", "sighting--3dd2f590-b223-472b-a94b-215eef236db6", "sighting--f762956a-85fb-4ca0-882f-dbe44b374b4b", "sighting--6d5822e2-a372-46be-b84e-8d532ef5ba86", "sighting--3f87a447-3325-4241-91b7-c8bcffad0742", "sighting--ef5ceb72-783f-4f1e-8fc2-d9d845f25be3", "sighting--20e6531d-e955-49ae-aa5a-4312a8508891", "sighting--cdfb45ea-c0c7-474a-b521-3484db570abb", "sighting--8468d124-cd14-4a42-b60c-d4bf93f78d46", "sighting--678fc5db-300c-453b-9c54-96b87ca1e705", "sighting--bfab85ac-2244-4418-b0a0-da07eea8da88", "sighting--78e983de-7593-41c2-b69a-f5ce0b79ef8f", "sighting--516e1bdd-1f2b-48f3-9bbb-41166818733d", "sighting--34e238fd-d1ce-4e10-8ad1-1e02df958f6e", "sighting--ae11b81d-204a-42a2-9997-c14590671b0e", "sighting--e2037fe7-b8b4-4e79-86a4-4e4e25779fa4", "sighting--e7873442-6336-4829-b43d-d962417f9e10", "sighting--a4c314af-6830-4dcf-9f55-19da504a2228", "sighting--291c7b41-21ce-47a4-b1f6-67218e5cc4fa", "sighting--3586e960-e015-4618-8039-4fc38f26594a", "sighting--2bfa8b14-f3bd-4f87-94fc-d4d2a60244ac", "sighting--5a73bfe1-44c7-4cda-b264-be7800ea4b00", "sighting--d63a28ad-f4a3-4d63-b4c5-c84e6aadd75f", "sighting--68d504af-2048-4c37-9714-3dc0551345d4", "sighting--739fb739-4fb4-4b9a-9cef-b0e46ead7acf", "sighting--e47e143c-a753-4ba3-9b1b-a9d77712ec30", "sighting--d5ab77b8-a239-4e4d-a32a-e5edf3b9a6e6", "sighting--cc257100-4085-40ff-b5f6-7fa60f989097", "sighting--d129fc30-3bef-4bf6-b9b4-6b3d87246d52", "sighting--a733891c-6b1a-42fa-8985-459437404b4c", "sighting--ac3346a9-94e8-43b8-9f53-cb409cd256c0", "sighting--1ba339f9-1cf6-43cd-8814-0f0fd8887ab1", "sighting--50f98211-f2c8-47e3-9999-54b86a3654e4", "sighting--1872f7fc-7e51-4128-aa05-2fd72e77bb3d", "sighting--e18c2b79-4e87-4def-8fad-3eb5f883c9e6", "sighting--9d76d41b-1b9c-4df2-865c-8984a5ff8b5a", "sighting--0002afec-f742-4985-9f70-e283d8ce1f09", "sighting--60a53f0d-0ffb-49a9-a66c-8773bda37582", "sighting--df199b86-bc3c-4815-bc85-219034aefe07", "sighting--5d68713f-890c-4c15-920b-6bf59214ec9d", "sighting--4d478b39-d52a-4db5-8dd3-2bc2a8549c31", "sighting--82de3802-f0f9-4ce5-8b9d-660126da9e44", "sighting--2224a1b9-1594-48fd-a27b-78c341fac025", "sighting--d22ddcfb-3ee9-420a-af4f-a3f036d50d9f", "sighting--da6bc8de-2e7f-4be2-bcf6-77233d62edde", "sighting--3fa98389-98df-4bbf-98ce-7f0e77318ee5", "sighting--15ba74e7-fbd5-4069-a6a6-9ee206611fe9", "sighting--e751cb13-3572-460a-9050-32392c0d01c3", "sighting--ebddc1f1-a89c-4ad0-b334-8fec315435c8", "sighting--10a7e86b-b51e-4ee4-8343-525099d6f946", "sighting--2947a828-f5be-46a9-8fa6-8d6cfe7c08f2", "sighting--0cedb105-d230-45f0-af5a-44f0037bcdd9", "sighting--c4bb8930-9739-4bc4-a866-cf8b70f8770f", "sighting--820130ba-da5e-4c29-8a8c-519b7fe049dd", "sighting--c9782d0f-0648-4928-8e2a-eb86ba25ffe9", "sighting--89e3c550-9a1e-4a9d-8bb7-b866929a6517", "sighting--0aa398f0-cb1c-4a29-8cae-62f547761bde", "sighting--e4e98399-ea13-4d92-90c2-518703f94ec5", "sighting--16d9a5cd-1413-47ce-9c3b-bd5ec496f2cf", "sighting--a7f412e4-93bc-437d-810b-5fe8f8092fb5", "sighting--44b2116b-dd98-4894-96ce-07cc8b97db42", "sighting--db128791-a76d-4a90-931f-a0098ca65370", "sighting--61c77c88-4209-4f33-8268-6f8318996780", "sighting--03b2a5d5-7593-432b-975c-1c2294c35438", "sighting--0b7b6126-33e4-454d-9c70-ac0d9f1b9186", "sighting--72b92983-c540-4dab-9e36-3a2321e13b6d", "sighting--2834b0aa-d09d-4c34-979a-8a5209720d69", "sighting--bf2beb4f-d1d7-4156-b897-794108f39095", "sighting--71b1787b-6ad8-49bd-9bc7-bd76c00adf8a", "sighting--35ee5828-0bc8-42b1-97a7-96221ce2fe43", "sighting--5c747a9e-1d2b-4ced-9a9b-36d5c559fa5c", "sighting--a3059d08-e0df-4925-a456-ec26d5f56915", "sighting--21bf0453-2112-4750-a198-193c51b41272", "sighting--7dca5864-4565-4bcc-8bac-acfdab6e4771", "sighting--167c574b-4a76-49bf-9a49-4ca7648cd16c", "sighting--cd2d86f8-828b-49d2-9cd4-a22ff4bef0d4", "sighting--4f7a5116-5bca-4e78-bd45-0b094decfd0a", "sighting--f9c469ce-4134-422e-943c-1d883ac04a22", "sighting--a2da00f0-9ab0-4501-99c1-7ecb89afedc0", "sighting--fb109194-e1fc-4c4b-a5e8-772a58d378c0", "sighting--5fce85c5-1bd8-4625-a205-7dbfa3d85df5", "sighting--db19c7bf-e08b-407c-96be-d2b874c845a3", "sighting--b8c8019a-160d-455f-aa1e-155729973729", "sighting--2e3ea871-7e1b-4bfa-bbef-3ddb5d677a96", "sighting--8afb7ce2-1f2f-494e-9338-cc8eeb6411da", "sighting--15f143c4-6901-459c-bbc8-d3bac0e06969", "sighting--21a3e8f1-9ba7-4cc1-8131-2bac8e441e50", "sighting--51ad1bb8-8837-443c-afec-0c4cc9b8184e", "sighting--6150cda0-e9cc-4aa1-8998-635b3bbb0fd7", "sighting--e9f62bc4-630c-4d6b-9b68-3566031e86ef", "sighting--006cd42d-b925-4657-8fe4-8b332d8a246e", "sighting--11ad1e84-b91d-4909-89a8-a6d0703a1cfd", "sighting--f72e39f0-192e-4e02-9c38-c8e5f5fc8292", "sighting--0e29a209-4397-436f-8c8c-54bc9612dd26", "sighting--2edf644a-73e4-445f-9ba9-6bb371f325ed", "sighting--a1e8e20d-a670-44c6-bf60-411417ada291", "sighting--e4c1e93c-d533-49e3-8d36-34fc4d47fdb5", "sighting--ddc09021-1a9d-4e90-bbac-16cb86e1969f", "sighting--71f09e56-5478-4e48-9e29-ae36aa7dd556", "sighting--6def25fc-3240-4a94-9c3d-db19a9610d89", "sighting--62e8e9c1-1b91-4d6a-b46b-c2a4b00bdd83", "sighting--6606ace2-d093-4f87-b65b-9764f8c58859", "sighting--011838b5-77a4-416c-bc93-e06ad5c7a3e0", "sighting--44e0fdc6-c385-405d-a65d-e92358a902b4", "sighting--fe593023-47f3-4874-a157-42d2a817db8b", "sighting--460e883e-c977-4fb1-a350-130af6dcd10a", "sighting--7435122b-990d-4c20-8481-b95487cac1b2", "sighting--397a6250-c134-4573-8891-96ad3739c996", "sighting--baf08241-c064-4158-91f1-a2dbab1e8753", "sighting--5ca04de8-8f00-4ba5-b078-71a20bfe19a7", "sighting--ae2ea5d5-1b96-41d6-b25c-cb3d5cb6d3d1", "sighting--a87726c4-0ab9-40fe-bce8-3c95701317a6", "sighting--efb1dd15-afe3-4d8f-89af-8363c268adc7", "sighting--ed501c67-e0b1-4c99-be76-4746c2f17577", "sighting--51ccaff5-bf1c-4555-b22b-73590a25fd85", "sighting--f7cb257b-772f-41ed-b9f5-2edec5cd0c33", "sighting--ef6e5814-7633-4362-a213-102b81c9bf57", "sighting--f73b5ab0-6827-4d11-a86e-d40d6cee78a3", "sighting--b5c3cb7a-929a-4846-863b-5f92eee5214c", "sighting--516c8a1a-eab2-4512-8bc8-66d14ae64fb3", "sighting--ae4f305b-e83f-4533-990d-54526c93cfa9", "sighting--e2020416-ca4f-4594-a000-191ddcbe89b8", "sighting--94aa8fb1-5797-4e55-af90-5b385752a5f8", "sighting--cbbedc61-20c5-4d25-ab41-78100e01c57c", "sighting--22504b0a-ef1e-4cfc-8035-cbf7f3bbb517", "sighting--b06f4319-bd12-4e4f-8d97-dfd0ce88be42", "sighting--a4ea1b57-8a4c-48ca-b462-5b35b3bf7e36", "sighting--39947445-6205-4bdd-bf7c-c639cfac7396", "sighting--af3826f7-88dc-47cb-a0d9-03f30479ada2", "sighting--9e143e8a-5c10-41c1-afa8-2beba969a0e0", "sighting--00e52825-b7f5-4f1e-8930-cfaee102f2ec", "sighting--2d4ed85b-76ba-4ddd-9c4b-baf53db016a4", "sighting--afc8f02c-edf0-49c2-90d2-c5d6a9354855", "sighting--a0b0c1cb-e01b-4136-851b-07d32a38bc42", "sighting--99cc8b89-0e24-45ca-9acb-1cc8a2dc429b", "sighting--a28265ce-e601-4f98-8018-0016c0720e68", "sighting--5182bc8d-c176-4ad2-ae41-824ebfdcc6a6", "sighting--ae7824af-398a-4301-b35c-04803a0404bf", "sighting--0bc5f6f8-527c-4279-b078-18ae057c382e", "sighting--bd402b91-fc5d-40cf-a23d-d0b7d440556c", "sighting--a0f0c6f8-8e19-4a7e-81f0-246b2124a1a9", "sighting--ef4c8096-b002-4f32-a30f-45a4be8a8439", "sighting--91b917c1-0501-4cbb-9025-191076fc4605", "sighting--5de4ff01-4fb3-4420-9ec3-b61c1ba9e3b3", "sighting--18e2b230-4eb7-47a1-87c9-09cbf7e63410", "sighting--5cb14a32-5dce-45cb-a758-ed73e2a50613", "sighting--be48391a-18ee-40b8-9f15-f1b646b321f6", "sighting--fac73220-c40b-4464-9ae0-1a1941a0e470", "sighting--15d26917-5bc0-4861-ac21-1fa1d698a7a8", "sighting--1022982b-9e02-40bf-89bb-e01260c2bfa1", "sighting--cd768cf3-17f1-421b-9667-dd605bfa24de", "sighting--655201d9-3d49-4b91-9e60-81a7db241868", "sighting--c73d962f-5c18-4080-b7bb-6c8bdcf599de", "sighting--86355b53-26c7-4072-8912-0499c43d12c5", "sighting--e11f7ebf-2789-4c9c-b685-81a992cfa097", "sighting--133237ca-c477-4494-be84-c042422c7899", "sighting--3e4c1146-ae17-450a-86fb-c0b2ba526d1c", "sighting--2084281c-a995-4bdf-9467-21df9b09efa0", "sighting--bf606809-fd5f-4376-8db2-eb96aa6fd19f", "sighting--41391a75-3334-4e18-baaa-68cf06128f49", "sighting--1b9be4c6-ebac-48af-8e61-b6f03631872c", "sighting--ed9335b6-ab3c-4f64-a622-43797e42e3d6", "sighting--947f3b39-49e7-4eed-9fe3-462e0710c4f4", "sighting--c601fd29-9f34-413d-baa6-c0af19b70efe", "sighting--08067afe-1f84-4423-9791-50d37ee0dbd3", "sighting--f13eaf14-36d0-49bc-8e80-a573c44192f8", "sighting--ae057f31-d0c8-4ab8-b160-883e05c83edd", "sighting--b38ce90a-dc50-47e2-b625-054c1448b156", "sighting--13c154ed-137a-433b-88fe-c3634efc4366", "sighting--428dff4f-10c1-4e39-b29e-69702ad652e1", "sighting--1f8af2b4-cf7c-49c6-a7d8-5c5861b662f6", "sighting--606737c1-cab8-4830-8b86-81f87dc0f69c", "sighting--ce4165ae-0ec1-4458-aae1-ff40604701d5", "sighting--65318fd4-f866-45a4-9d67-127efa078d59", "sighting--2785dfde-9bba-4490-ad65-a1bf152ef8b8", "sighting--6fd8997f-a09b-4a64-800f-dd6a693dcb71", "sighting--1206a07d-6aeb-4a24-931e-c7d5a5407096", "sighting--d0c34a72-eee3-4f1b-a5b8-d959cd2d30b9", "sighting--caa60a30-65a7-4902-9c7a-66a43eeb88ac", "sighting--95767e56-9493-4168-a24b-cc17f01a7378", "sighting--6cd9bbfd-c3a0-4ed2-b73c-6f5ac043d253", "sighting--5e933fde-ee53-4c16-87cd-2ff8aee3166f", "sighting--eee61c59-06e0-451b-b1fe-71c4102d7ece", "sighting--43d3b02e-f970-4e9b-87be-9eefde930f39", "sighting--7e08ad9f-caac-40ca-946d-f16c6c6723d9", "sighting--190930dc-c646-4bac-bf26-21b5e1af1be3", "sighting--3b30275e-e59c-4cad-92b2-f84384fcc684", "sighting--b57157e7-cbf2-400c-bf99-4a9e77d9b0fb", "sighting--3e6831a0-4c30-4e08-a69c-fb075589222b", "sighting--6a2437c7-9942-4437-9a3d-90ee744d9a5e", "sighting--117fa934-6a38-422e-b782-9a09e4093ddd", "sighting--bb6ce0ee-16e0-4c02-9905-e0915bce4e90", "sighting--d56d8b1b-9fcc-46d0-a26c-bb72918454ff", "sighting--fe9e7549-063e-44f6-a580-3bb3b997d5e3", "sighting--2947a3b7-392e-4c27-b82d-33928f093167", "sighting--6c397fee-545a-4b5e-8232-a8ce6e73600f", "sighting--1e88ac8f-114b-4ef5-b039-cefc8d5a8ffb", "sighting--ae0b560c-133c-40c7-9d51-418b110b8826", "sighting--0848358c-0e0e-4089-9ffc-92b7d1471acc", "sighting--d0c10fef-715e-419e-8a30-94ca669f2684", "sighting--f0fb2833-3015-4402-9646-caebc59b5818", "sighting--e311ab7f-1c71-4992-91c1-dbf174c298a6", "sighting--15b23d17-bb96-4b2c-96ea-689908d695aa", "sighting--994eadc0-a5ae-403e-8836-44a45ea0a063", "sighting--35a8a022-2cb8-47dc-8b95-f64c1db8d92d", "sighting--3ce18704-2e7f-42ce-9ed9-697f75f78951", "sighting--ea848b61-18bb-40c7-801e-55db8b92bf5a", "sighting--46ae7f95-6251-4348-9ae4-a31da02ee377", "sighting--198c4f10-94a8-43f7-ba84-1d794d9a26bc", "sighting--f30e21a9-cb7a-45f9-ba0c-7dcd893d44e2", "sighting--240a12c7-f958-4be0-9da7-adc3100b4c6c", "sighting--f70a4793-d9f5-4e0b-9e39-2f340932e756", "sighting--df97aea0-d6ab-48f7-89c2-8091dbeb8c0e", "sighting--9a25ba1f-1ac2-4b27-9ff1-abffbdd10ea1", "sighting--5e83604b-e4d4-4792-8692-2043d7d32dd8", "sighting--f5bb2c05-c7fa-46c4-b1a0-aeaa327eb0a0", "sighting--82bfcfb1-7da7-4617-9a50-5056e3518b26", "sighting--926c1178-3114-437b-8916-39792e27ad26", "sighting--ab5a5897-d003-40d6-a4ad-11b43ebf95d6", "sighting--eef6bc4e-88b6-4022-894e-04a8b20fd899", "sighting--f3007bf0-04fa-4807-aecf-cb22ffebcd5e", "sighting--2bdb282b-cd00-4184-8ec8-d9f49fdf773a", "sighting--127e7c5c-d191-498c-9111-68ca6a7e510e", "sighting--0448a172-413f-4089-93d4-01dd4cf2ee80", "sighting--15f4e383-4de6-4998-b5d6-38fb9c1aee0c", "sighting--82321648-7125-46c5-b436-ef69a5fb9d28", "sighting--9e7b5b2a-bccc-49c9-9af4-151711311ea2", "sighting--ea0bfc4a-43ec-4071-9bf3-baee836c2ef5", "sighting--1c633eee-6a3a-4a46-a223-b2e9fa88078b", "sighting--54de2a27-b508-4c81-993b-42ffbe15c96d", "sighting--67eb6ad3-a68e-489d-9ad7-7b9f76a804ef", "sighting--50ba64f5-a754-4c84-a303-6864dc7ea3a4", "sighting--1cc4621b-ca88-452d-a1b3-7b6caa4e87af", "sighting--4a389961-51cf-4bb7-9ca0-e89d62f9abcc", "sighting--2eac0282-60a5-4322-a1bd-7e969ef25c59", "sighting--6a6d1e1d-9b4b-4537-8bee-09a055961ab0", "sighting--b40894b8-fa87-4ed6-b95f-38d9f4b7d203", "sighting--7e124d35-3c7e-4584-9fd8-887d4471ada6", "sighting--c8a96795-6f0b-4f60-bd52-92bb1421b0d5", "sighting--0f7375d6-9fae-46a4-ae46-834e797dd512", "sighting--8edebe66-55fe-4024-a790-96a3c21525bf", "sighting--c30dc98b-34df-49ab-8b78-74f69aab297e", "sighting--07b26a86-f895-4a0b-97a9-4a71a2e3d44d", "sighting--9443382a-d3a0-4bfc-9581-3730f15f6b5d", "sighting--a7fda3cb-9f9e-46e1-bb10-f9307ae4f0e9", "sighting--29839796-def6-4650-b54b-77dd8cc05a4b", "sighting--d6b60276-07f1-4829-ac61-8066c9cd2833", "sighting--4fbada2c-e97b-4a5c-8019-16148aa8680c", "sighting--e8b90073-5bfa-4245-9701-4ba5afab92f6", "sighting--a553c771-a20c-4aa1-b87c-c085c5fcea65", "sighting--80b456c4-eb20-4add-9aaa-485b210c1b93", "sighting--0a25ef76-af38-4fc1-a527-fa54a2823b8e", "sighting--aa3b7014-4f6f-48bc-abcd-3c8f70162c0c", "sighting--8c51f162-7e63-4128-9e86-3f883a04a97b", "sighting--bc341e49-23b6-4d89-a347-e4506eaf3e98", "sighting--845757fb-6db4-426e-8aea-14b406045fa9", "sighting--740f17aa-a558-4727-884e-2fcac5fc2aad", "sighting--dc8d324e-56f9-4067-9512-1e3c94c54dea", "sighting--b0ec84a1-ba6c-43f5-b600-3233f93dc759", "sighting--6eef043d-348a-4dae-be90-9085c663a31a", "sighting--d9b0daa6-e739-450b-9cc9-da047d181e3c", "sighting--4784c068-c9f1-4521-a6e4-272ce83adeac", "sighting--c5e7beb3-4114-4e60-aec5-589779913da0", "sighting--b371d590-e321-412b-a934-fdd9be80a2a0", "sighting--e943d514-3f78-45f1-887d-90ba6eeb3f79", "sighting--61080ce8-956c-4e82-8e03-f197ac0afc59", "sighting--2e679846-5d79-49c1-a3e2-e4fa5e2c78a9", "sighting--39595bdd-9731-4ce2-b08c-4f899c6a72b0", "sighting--77ce16bf-50f3-4b42-a3a7-4a3d6b0971d2", "sighting--e0154248-49d9-4052-bf01-73ac8af8d1c3", "sighting--6e61e05e-25ff-4217-ac02-e065b467c4fb", "sighting--a92faaeb-65fe-4ae0-a2cc-b4ec56aff7f9", "sighting--d3031472-5faf-41af-b599-d3e07dd67251", "sighting--73daefb6-82ac-4fce-b8bb-2f83e9171450", "sighting--79162fa7-1e67-406c-93d6-57cc3d735161", "sighting--76ed4892-7811-4651-ab88-4778ac80a1b0", "sighting--9112067a-91d8-4ee1-9f2b-cab6b8b1f7a9", "sighting--d4b1d328-fba6-4b8b-8ade-3a51806dca34", "sighting--e5e14449-45b1-45af-97ab-6c523caa2dee", "sighting--e3995fbc-c061-47e2-aebf-cbc8d54e15bc", "sighting--9fddacc5-b7ff-4ca7-9912-64132c27fa7e", "sighting--4645a13b-95d5-4680-bb99-8cf9f4e9ad9a", "sighting--078da5ab-ffae-4c42-b406-3c907cb9a73d", "sighting--da0c0384-1549-4410-b71e-5536a8b549a5", "sighting--19354d23-a484-42f0-8fbd-236b394f6d23", "sighting--88a9d1df-b1c4-4a62-8a95-3bf04fe49b5e", "sighting--95c6a6e5-7675-49b6-bf45-a1aeebfebcf3", "sighting--5c1cb17f-b15a-4e2b-8690-c51a77ec6229", "sighting--9efb19c4-f85a-4b3e-a192-a4d7f13469f6", "sighting--4ea05a33-3c32-4f0b-846e-1ecffca5571c", "sighting--d2e59e27-5125-48b4-94ce-8de14a64135f", "sighting--d6d5b763-15b2-42ab-bd11-a507f7db760d", "sighting--9b147c12-d098-4db1-b574-9d9c2cbfd283", "sighting--e1d5c7bd-1336-4c40-a2d6-d692ec0ff709", "sighting--f7c05320-f3ac-41b9-b815-90a3a882cea5", "sighting--907f8a11-9b50-4108-9a6e-8fcf018b567b", "sighting--b4307068-0fd0-4c2e-a084-ed203bdc2fd6", "sighting--ebda5c1a-1b8c-43db-a4a2-47aee6196537", "sighting--2640eae6-cc86-44a1-86a5-49a22a0575ff", "sighting--7edd67ec-0ebe-4509-9900-dd9856d653bb", "sighting--be1a8fd8-c829-4851-83d3-7c18211f83e8", "sighting--410d4e95-deb4-4431-821b-93fddb8e1397", "sighting--69eccadb-50f6-4ed3-9d81-6906712b4cb2", "sighting--115a1926-56e6-40e6-8aef-3af35f7c8bbb", "sighting--d14f5902-6bf7-4b0f-93bd-0e829dbda4ae", "sighting--e6d97b1b-238e-4d67-80ad-64d2cae83759", "sighting--8b85cec3-149a-4dd8-848c-939d08df3f9d", "sighting--f721c3bb-51de-45d7-8e15-4b604f6c5b24", "sighting--5b56a3e6-be40-4af5-b89c-bbc9596e3fb3", "sighting--87df4289-ce83-4b1e-a2ea-9a45830e1fda", "sighting--aea1da41-35d4-4b5d-90d3-a4c6bd9f6a60", "sighting--4be70f2a-ca4c-4258-9c5f-f9473990aa26", "sighting--d5fa60e6-e397-4903-96e1-8facf17a7507", "sighting--bdba77c7-5e76-461c-a354-406d8c4c729a", "sighting--9c870b51-fbfb-4c97-87dd-25e962706aa4", "sighting--7529f64e-5b41-4ae1-8c22-c602a3b81251", "sighting--9ecb5ba1-7967-45c1-8699-50a82d2fc340", "sighting--d01c0eb8-6824-451a-b438-62eed8416c9f", "sighting--a103d386-5c9b-4aad-a4ea-0d90206a151e", "sighting--4c86584e-2d31-4d9b-ae4b-0a1412f2354d", "sighting--d6812f60-a77c-4b84-a97a-2c8e15ca267d", "sighting--7fa39ee5-349a-4671-aca7-365f9be1e08c", "sighting--7dc6bce9-6984-4652-9fbf-f43947970d85", "sighting--9c3780d3-9f3f-4ec0-81b6-c49bc0735893", "sighting--0c8ccd15-82b5-4457-9ba6-77c3153169f1", "sighting--0f2d0f2f-5e84-4d33-a893-4910d79d834a", "sighting--5b46b3d1-b9ab-47e0-8097-59d19c56ed23", "sighting--13f56d6e-1537-462f-8dd9-900ded7e2aff", "sighting--424ab883-e218-44f7-a021-46aa2c8adb9e", "sighting--0dfbfcc8-9075-4f55-b122-7ca7acd23cb4", "sighting--bbfe4bf8-5ecf-40f1-9fb2-e2584190f7bf", "sighting--4448d2f5-ee2e-4483-b5d9-e03a90fe0452", "sighting--2d5bbcb1-910c-4dc0-a787-24d42e2f5ae3", "sighting--23a4baa0-4090-41f8-b3a0-49863d3f4dc2", "sighting--73dc8b4a-f08c-4c05-b61a-e3b2f1dcef2e", "sighting--b86ce0eb-d4cf-4763-8630-6625c411a584", "sighting--fc918d42-7b27-4733-81ce-864782c7c273", "sighting--138d1db5-8f1a-4861-8078-aa157d45bcb4", "sighting--050d2489-62dd-4883-91b9-74ce0eb7b95f", "sighting--102129bd-b71f-4dd2-aa77-6de056459b57", "sighting--a8486a3f-85a6-4f2f-ba44-628159385a3f", "sighting--e247c30e-b2ee-451c-8551-dc8ffa62607b", "sighting--7765a2eb-859a-4838-b218-67e6582d62f0", "sighting--5e2f32d4-2f70-4c87-b9fd-cd558b8d7282", "sighting--f82685ad-98e5-496f-ae3b-2cb25590a872", "sighting--4ffe82ff-e885-41a8-a60c-02a30beb5741", "sighting--b00bb0c4-26bf-459c-91d6-aa214941a106", "sighting--f47f9b24-c4db-43e3-bb04-2fdbc9a07ad8", "sighting--c4d4d669-c011-404e-927a-2aff77fcdbcf", "sighting--b656b7e1-be01-4f51-9669-43f7609be1bf", "sighting--b3d2c14f-042a-4877-bd4e-01c0fd1802c1", "sighting--c56991f7-55e7-4535-b584-6c0e10047079", "sighting--f8fd132d-78c2-416b-8341-e6f15962a437", "sighting--58016a5a-3b97-499c-ae4f-90dfc64fc968", "sighting--68fecbe7-e372-458d-a1fe-c8d189a8786f", "sighting--4fb35953-535d-40fa-bda8-9959c6ebd8f9", "sighting--d6115f64-d6d2-4c0a-be29-88bcb586adab", "sighting--255ec559-1b94-49d9-a7a4-dbe03c48dc10", "sighting--52354ddf-9b95-427c-9f8c-8e14ca412b5f", "sighting--69c4c94a-9a0e-481a-a4b0-dacca99756b3", "sighting--8545b3c0-fa16-41fa-813e-8977ec97e673", "sighting--00dbea31-777f-4388-81f2-ba79e47cc07e", "sighting--689c6db9-08b6-4844-8e61-282a31e8d985", "sighting--dd07a9cc-4cb4-482c-888d-56ab258081e9", "sighting--c4178618-3924-426e-91af-a9ff5e72438a", "sighting--61ea5a6c-7e8b-45ed-8291-fa7e276a4df3", "sighting--ef2b3938-7d95-4a99-9557-645913ca0360", "sighting--2e490b12-95e1-4ea5-b18e-08e89119f983", "sighting--8de121b8-919b-4584-8717-d4c486c099d5", "sighting--1d444112-372e-469c-a708-aa1a6620a136", "sighting--2b063fa2-d376-4f23-8976-3e42da2b652b", "sighting--adb051d3-223b-434b-bedc-dda30523ecb8", "sighting--e8bc6656-cc5b-49c8-acfa-6f33fb0192d6", "sighting--7f06e834-8173-4c10-8744-909ecd7101b6", "sighting--1a541cb9-2d3e-47b9-80f8-4daaae9d4733", "sighting--17da215a-fd3f-4207-b24c-8ec162189d50", "sighting--f46890ab-fb89-49bc-8fe9-b3daed171d0c", "sighting--a7e054d0-2477-4e7f-9995-c47741b90189", "sighting--dcbbc8c8-1aee-4d25-81e6-ce0239a014ec", "sighting--473b8204-ca4e-4083-9638-3f033cf5d302", "sighting--e43bbc22-74a2-44d7-8019-65a50793bc36", "sighting--1615b7ce-f382-4f39-bb77-7089787aa4d0", "sighting--37c718bd-22fb-4d0f-9726-ad1a31fd2554", "sighting--040c6866-dc42-4918-9c1a-6ffe7d8f77fa", "sighting--80d66394-ae1f-429b-9bfb-22f1d3fe99cd", "sighting--76f184b8-bc76-419b-85c2-208340b2ac84", "sighting--3543d3f4-8ac0-4d29-adb5-81844ce6e252", "sighting--7937e2b5-2596-4816-b3e3-7bb6d079f05f", "sighting--123f4368-7de4-4390-bd5d-0226007a1894", "sighting--9fcda29f-21a7-42f2-95c6-18dedb836918", "sighting--7e9be05d-a57a-4855-9dc1-09dee47fb540", "sighting--16b6026c-33d3-4c3a-8e38-a46432578efc", "sighting--92d153d7-4221-4434-a670-7e3d935e8026", "sighting--c03e750a-d7df-4a53-86b2-c32860d6b7ca", "sighting--d2ed75bc-289b-4001-82ba-cae76172cfa3", "sighting--e99eaff3-d698-47ac-a997-0d8257af321f", "sighting--69b42ef0-cff8-4ea4-b976-c6e1785176e4", "sighting--309ef52d-5c5e-43a1-a84f-a5a634abde44", "sighting--c2fa22be-1f73-473b-b91e-336cc5de07d0", "sighting--bfb84992-1632-4151-b0ec-5b0b60500675", "sighting--d1630cf6-4452-4f04-8b30-6972f09a096d", "sighting--a919dd35-51a9-45e4-b73a-1ec568335278", "sighting--69d2618d-7169-4810-963a-4896e157237a", "sighting--11ec7e3e-6558-4d1d-a870-91c6e4fb889f", "sighting--dcdd8a4d-7fb6-4e2e-8171-dacb9668ca3e", "sighting--9e909df5-bbf6-459e-8114-65212db3121e", "sighting--932b9478-f86c-43f2-87fe-a1c7cc71b8cf", "sighting--eadc66e0-3fbc-4d4b-baed-bfd0be67689a", "sighting--917b9e14-a84c-4af3-b1ee-7925a0d75a40", "sighting--8ce6d1ef-8f34-447f-8a77-a4a822272351", "sighting--bd607052-03cc-4f45-b4c9-04a97a23999e", "sighting--8f46fd77-353b-499f-9b20-ca351636c270", "sighting--3337d882-4e06-46bf-b925-1768536652f5", "sighting--4f962fc7-7631-44f8-82a8-27be046e81f1", "sighting--7267a938-6caf-43ef-b579-4620109d30f5", "sighting--75c780d4-a455-4cfd-8ff3-1fe173730f42", "sighting--2a81e552-2f88-4c4e-af99-17f8ac6af8dd", "sighting--10b607c0-9e12-462b-a572-f27e64457dfa", "sighting--53c9bac1-b493-476c-90f9-33be7b129c16", "sighting--70e7e14b-4c75-4c1f-9934-c56bc1248ca3", "sighting--506d2d7a-6f95-4502-9044-b1d11a049b73", "sighting--a1acc45c-3818-443a-9d2c-d6d085ff8c96", "sighting--719977e8-f432-45b7-9b6c-e2d4a6d8a00f", "sighting--ea84059c-0321-45bc-a5c9-7e883b407757", "sighting--ffca8452-6017-4977-9a72-337ef761b093", "sighting--7fed6e79-9740-428e-a01d-d5119bb7c382", "sighting--64fab9bd-f5e0-4a38-9726-45ee00dbee9b", "sighting--f043decd-68ad-473b-8968-e8113a9bb931", "sighting--801f606e-115c-492a-bd89-69098d6f170b", "sighting--ae630cb2-b7ae-41c6-ae7e-8cea938c6159", "sighting--7fb5909e-9f4e-4c6b-aed3-fcfa4cd13444", "sighting--bf91e5fb-e15f-4461-8de3-b9a3644dcf0e", "sighting--ebf3c8c9-db90-4901-aa36-c058319e72f2", "sighting--21c1df1a-003c-49d9-be81-e3fc7f1b3dc2", "sighting--81c6a4c3-fe57-46b4-ad9a-b0641d79b3a0", "sighting--6b54895f-0d7d-4f9f-b726-f84275df3a42", "sighting--120c4a60-fbb9-4936-9c8e-c3a31591fc56", "sighting--395006f3-e063-4af9-a7c9-1a28f66a4b8b", "sighting--71971b58-b194-4c3d-b421-02eaf7915029", "sighting--9038fbdb-a98f-4c84-a6cf-75c34523658e", "sighting--4ec419c5-a47c-4731-bc9b-9b68fed2bf09", "sighting--c15bac4e-56bd-4f19-a09e-557b38811f52", "sighting--89c1560b-1498-40b3-8b06-ec506039a65f", "sighting--0b253e83-9233-46de-bac0-b949d4dd5d03", "sighting--de610a60-4183-491d-ac68-701f1feb8936", "sighting--1a006fe2-2c10-463a-88ea-39f9d81941a7", "sighting--da389516-718b-42bf-83c8-2b081f43ad49", "sighting--749e96e5-30fa-40be-85fe-0c8648e13069", "sighting--0cb2ecb2-4744-4c64-9a2b-7f866850c462", "sighting--5e3001de-bcc2-4cf2-96c2-87640640a168", "sighting--61099cdd-10a8-44db-85e1-d6b7599b1769", "sighting--eb2818e3-9e0a-4e59-bdc0-14ddc5e527aa", "sighting--3c6d7a3b-74b8-4614-8cf8-1524b45c2cd4", "sighting--386ab0e2-1a81-46db-9d21-060965a6fea7", "sighting--f8ae7f03-21f2-46a9-bb65-9ed82f8379be", "sighting--e8fb1799-0dd2-4853-96b4-637ef63d89b2", "sighting--836672a6-f560-4b44-9575-0d38b5e60e8a", "sighting--7bd786bc-567d-4ea8-88cb-e65703d48012", "sighting--4e2e8164-1ae6-4c20-aa95-eabe18a89137", "sighting--2fb364ea-c828-4300-b1eb-85ba9934e71d", "sighting--92a3fc13-a0fe-454e-9662-cdb5c8cf827f", "sighting--a7a7a063-9253-4fed-ac70-643d388f1752", "sighting--64299405-46e6-4753-8314-0ef92edac001", "sighting--6a1265de-e3c6-429b-9539-ebca47ab45b3", "sighting--1f57f92b-0a1b-4158-8d6b-b1fbf385e6a9", "sighting--143f462a-c847-40ff-8e6f-83ad73f74dce", "sighting--630f84c6-310c-4aad-a2e4-6b5d9e979246", "sighting--9f46841f-f00e-4354-a9a3-924431aaef95", "sighting--3f4106dc-ed32-45b0-9d93-38c5c4772721", "sighting--8cfcf357-60f0-43bc-9b56-b8f7c77b6baa", "sighting--5d068acc-cc18-45f7-99b0-6fdbe4c1383f", "sighting--98ae8a7a-db60-4261-84d7-13214778aaf5", "sighting--711dada9-681e-4de2-b1e2-a3a2bd61e7e1", "sighting--4c96ad57-281d-4913-88fe-f534075e9fae", "sighting--05a8beeb-65cd-4fb3-aeee-a42b62e9477b", "sighting--4cede9cd-4429-43d9-90e4-a6e0d84b3952", "sighting--197a0c55-b0e1-48f2-901d-b93238564087", "sighting--6e3ddf2f-722a-4cb0-8514-04a11e70da03", "sighting--f3bd83d9-b1f2-4743-87a1-af812a3ae3ab", "sighting--f1d576b7-f0f7-4106-a333-1e8336f1761f", "sighting--f2f28751-ad45-48da-b34a-3d155f6a46cc", "sighting--84cd7ecd-f4fe-47aa-a78b-dc31002d0f0f", "sighting--99656753-ed89-421d-aab1-a1f32eca106f", "sighting--48033c85-7eb1-4920-8702-131070f377a7", "sighting--b9d0a2b0-8051-4554-8551-71089032b96f", "sighting--a1fdec64-acf1-47fc-aa8a-c5e9296b1d0e", "sighting--7b4468af-623b-4f27-8ad2-74928221f47c", "sighting--45d2c0d3-1bb3-4c94-aa06-120dbd197601", "sighting--2eb9a0dc-875e-45e7-a8f4-30f3d95ab044", "sighting--269fbbf7-2c60-49e9-8bc0-a89a07129ea3", "sighting--a44f4c3e-18d6-4732-8d60-92428442b0f3", "sighting--dfae3516-d290-4a20-bcc5-01b667823dea", "sighting--a9ff71c8-8091-4811-af96-77da20fbbd33", "sighting--78d44ebe-88a5-48d8-8a99-585d9dc79269", "sighting--bffe1f34-d533-4025-91c6-f59a3dd37e41", "sighting--5548a3c8-164b-4822-95cc-819fabe29d29", "sighting--e6da36be-e227-41c5-9deb-5e8c00dbb92c", "sighting--6e3099cd-4a4c-4cf3-9be5-ef6522b57b8d", "sighting--a79b33ba-6c70-4315-a8b7-e47400a72970", "sighting--7e05cec3-b78d-47e1-8dcf-8a72c240062a", "sighting--b2d07e98-bd56-47e4-ac77-f81768238468", "sighting--4df670c0-5384-46cd-bbb5-798da8d367c2", "sighting--efdaedd6-691d-492c-b64f-704226816f6b", "sighting--30c1bb62-b744-4882-a1f8-c04fd2f9de77", "sighting--ebdb1741-57ea-4bf4-b218-92ab6d32b7d0", "sighting--07c28b0d-bfe1-4d18-8a1d-63219f445377", "sighting--641f7a78-b018-476a-8473-88f9ee6d3b57", "sighting--7e1d483a-c2d5-49cd-b7a3-16f424da7cdc", "sighting--74fc4105-72ff-4918-9a44-06f968d47158", "sighting--79551323-2bcb-4838-bab6-c48da67eafdf", "sighting--f89707e9-502c-412b-98d9-c04abc2cacc9", "sighting--7309c983-06e9-419c-97cb-b066ca299944", "sighting--1bed149e-9b11-4044-8941-c217857a5174", "sighting--2bea8c5c-3708-4de6-b92e-884aefa7e6f8", "sighting--ccdefe18-72b8-4f86-be96-3c82241a21e2", "sighting--ec07d49b-ce9c-4470-af90-2439383d3945", "sighting--c6dc650a-9c91-4dfb-a84b-4bcff915c0a4", "sighting--ecb78904-1442-4799-abb8-452ec8b5252f", "sighting--cdb896e1-9ee9-43a4-8791-d87f0cd9f00f", "sighting--ec641c94-9374-479a-a271-92c7a6fa6f30", "sighting--f2166967-d0dd-42cb-8c3a-e285b3c80874", "sighting--80d1f879-4242-4f65-876d-e933bc143249", "sighting--4fb83b69-3f8d-48f1-b45a-aea50e31cbaf", "sighting--1cf40246-1d6c-4e92-b120-74710a290876", "sighting--1e1a05c7-1867-4d68-bdd1-5727d5a5d2c8", "sighting--be09ac12-437a-47d3-894b-f7a8b0e62870", "sighting--5a9f7835-90b2-45a3-958b-1f697e7bcb7c", "sighting--c20cc7fd-f08a-49a8-a9db-1e79ab964907", "sighting--b53c3cc5-ced6-4542-a63e-d2441266b213", "sighting--d810a214-a5cd-4a00-8fb1-5cfbd7369d4c", "sighting--91236e61-6600-4711-813c-b454287c74f1", "sighting--9708b6b4-b6b9-479a-8ad1-3bd4bb16a1fb", "sighting--83417260-3a45-4b68-813b-401495c7a54f", "sighting--0cd5f272-a79e-47c4-8e5b-8c72ea39d712", "sighting--3fad81f5-2187-4106-b266-91420939c81b", "sighting--4bbc3167-ceb8-45db-a42f-2f0da6e2383d", "sighting--31db4111-640d-4f76-8526-f5de02ef3427", "sighting--fcccdfdf-5420-44be-84a4-d438564bcb88", "sighting--5f370d75-0114-4eb2-9b54-077348a138da", "sighting--eba00c40-f9ee-4443-b5d3-1cb11cf0d7b9", "sighting--4ccf2d45-fa8e-4869-8bcb-82407b7cf381", "sighting--339ad97b-7802-476a-8166-e4066a6f7a83", "sighting--a4a2223f-4cf0-4479-a7bc-759700b333a0", "sighting--cd8a77c8-51dd-46d4-92fc-97cccc227912", "sighting--c4b51d4c-622d-4f6e-b674-8f33d055e51d", "sighting--87e5432c-ecd8-4965-825c-e87f75121510", "sighting--aac9e259-08bc-46d2-bc3f-599263aa341a", "sighting--b2325f11-4e39-4acb-8100-1d0841383da5", "sighting--500b1c28-5bbd-4172-b6c7-be6cb8952136", "sighting--25684212-9765-43a4-90d9-e46d1a8a516b", "sighting--d3e336b6-ccc7-4eaa-9fb0-a54f77fe2bbb", "sighting--58bdd3aa-754e-49c2-9385-10b3096a53ec", "sighting--cb5f8906-6569-4975-bd77-d4a1093e31cb", "sighting--4a08c1cd-17c4-49ab-a8b6-7469531da697", "sighting--b1b05704-ea90-487d-9bd8-35d7fc7d7551", "sighting--48039048-c663-4034-80ab-fb3d437abe62", "sighting--e6251689-9242-46ed-896e-99b4d46a8698", "sighting--592f4081-a7e9-4dee-9798-1c6385ed572d", "sighting--246b970f-4a39-456f-8e78-7be72e8708d6", "sighting--39e18594-b0a9-49ee-bc7e-91c7d996d5a2", "sighting--0a61f13a-982b-45a6-9b76-3034d66bf256", "sighting--2a3c7a66-abf6-464d-827e-4ee094e3a12c", "sighting--7dfa2d11-2a93-47bb-90aa-a010d7e15a82", "sighting--e0b73df8-8810-4965-80a5-48f483fd7df7", "sighting--6cff1e69-ad22-4870-ac4c-377069cce759", "sighting--145f68d4-e9fa-4c0c-a580-687f9aa229f0", "sighting--bf6d76b6-14b4-457b-b3c8-ff1cca1d0fd7", "sighting--1ca74445-634c-470b-ad16-4fcbdc2b6e47", "sighting--9c0d31ba-35e6-46ee-8a63-42b228148246", "sighting--9c528abe-05ba-4b07-b47f-f4216771bff8", "sighting--1cb90694-b6e0-4ac2-937f-2ef102c1c947", "sighting--3daf87fd-6fe3-4a71-9436-98ea3eccf52c", "sighting--3188e8ac-e5a9-4be9-a8a1-c2f002dcac2c", "sighting--faadcddd-b22e-4c8e-b7da-d92fc6d0ab00", "sighting--0671b48e-e0c9-4fdc-8a54-32802eb5fbd6", "sighting--f1f1570d-0a46-45ab-950f-fc9e56cf96e0", "sighting--ee0ad7af-5602-4ba9-9f8b-92b585ab4e4a", "sighting--d19d8532-8868-4797-a46b-a9b16278c238", "sighting--598a6ecc-2998-4c6d-b272-47404e3cb6aa", "sighting--74052a7b-f671-4a7c-bcbc-ae8a26918fe7", "sighting--21a4c014-a4c2-4d94-9715-c534e0d79169", "sighting--9e37561b-0c7b-456f-ac90-5f5423c075e0", "sighting--bd214206-0feb-47cf-a424-b63702fcc065", "sighting--f09e649b-40cd-41f8-87f8-3b845ccc3527", "sighting--51c828a8-627b-427e-87fc-8980c9493cb7", "sighting--9fd15426-d33a-4b03-a591-7a77594fd0f8", "sighting--a7fa12c6-55d8-4d05-bb5f-4f8a5720bb75", "sighting--1fc84100-58f2-4d9b-b7bc-7cfa9545a893", "sighting--7ea05f1b-7123-4596-84e7-e9877c83a3ab", "sighting--f60ad9e5-e8d5-4ba5-9b95-91f663e34fbe", "sighting--a3dfca26-979d-4cc6-8f43-f0ffde20c28f", "sighting--b33e2558-95fe-4609-b043-42cc939c2a4c", "sighting--2703d902-8243-4e75-b097-3bee533da6ab", "sighting--82eb4233-b032-4649-a2e3-003ca111571a", "sighting--89552be1-9be3-4b12-bb7b-5fcd1f555bdb", "sighting--1b4b07f9-b80a-484a-9b60-d3b9a3141bb1", "sighting--7b56dfc3-0e71-43c3-b8b4-ffbb4b3c1b5c", "sighting--fab507fe-989b-4512-b2dc-543c4e00a11b", "sighting--516a0555-82f3-4c29-aaeb-8dfe6cf1d26d", "sighting--cb79db16-ed6e-41ff-8721-0aaa1019a514", "sighting--3f7ffa1a-710c-4dde-a5e3-922c3cbd28ff", "sighting--89565566-4e90-4e0e-848a-e2ec36209d4e", "sighting--2a97ad50-71c0-4176-9ad9-8d5af6962bbd", "sighting--c7e931f6-97d5-4951-ae09-737ccf1d14b4", "sighting--eb4f06a2-3ee5-4d78-9c36-8a60e44e63d9", "sighting--14e0563a-e459-4de5-b1c4-0a6fece213af", "sighting--c9fe6928-3ce8-4786-b83a-e7f54bb794db", "sighting--b8c0dac6-bf80-4635-b36e-9e906859626a", "sighting--59dc5edf-d45a-4e0f-a248-132e4f9ec7bc", "sighting--b934a1eb-0566-420a-ac33-35bce8e59092", "sighting--0f65895d-caef-4fcb-80b0-da1417f886c5", "sighting--642091d0-8c87-4a49-9574-a9672538c9af", "sighting--5f3ad598-6793-4d3b-b22e-a02ce146f4ae", "sighting--94af81d4-cc68-4fbb-bb27-52e112377811", "sighting--f2a48616-5f36-4a79-8e48-7f537175a2f1", "sighting--28fcb2ad-cf12-4636-a5a1-17f4a82f4a23", "sighting--aa4715ea-be50-40c4-92df-298b32e21639", "sighting--9c93fa64-2c79-410b-94de-9ec6b3e0c7d9", "sighting--7b204cdd-7aa0-4366-a04f-e4d11975cecc", "sighting--03116f09-2c16-4a84-9b56-e45bcfa3b989", "sighting--a436d8ed-2cf8-4a0c-8921-9753efc56ad3", "sighting--ab43df8b-4fa9-44d7-96ae-b1832f6a6247", "sighting--4ee6e18a-34f4-4a68-8496-c3f33cf60965", "sighting--6efe79bc-68b4-4b90-9c9e-972c4a37b336", "sighting--a06240a3-38ae-4be8-a830-478deb7fff9d", "sighting--a375d22e-c892-4cb7-b3a9-25b6d8c01cea", "sighting--e176545d-6ba6-4b67-ad7a-c97bf7c11b8c", "sighting--43dce983-2765-4b73-8bea-4f583ba3c7a0", "sighting--b9d4faa2-04f6-482e-a746-c83e3ea0626e", "sighting--5172f963-d8d9-48a8-bebc-a400b08b7982", "sighting--18bdcedd-df03-42ec-878e-28ebe9df627f", "sighting--442718ef-7e8d-47a6-a3be-ce1bfbe5f689", "sighting--5b8b7ca2-9d0c-4325-a18a-b4896d5b1667", "sighting--a4d54935-d53a-441e-a1aa-ad6f6bed0d38", "sighting--9c7f0609-9fac-4b2f-86f6-6c1deb2ee43c", "sighting--ef5f05f5-9613-42a8-9cc6-9b7551ad0c5e", "sighting--3de54a7e-0701-427b-9760-952ac79ef3a8", "sighting--5cd0d736-7bf2-4a77-8ff2-d167c21176ad", "sighting--3eed7fc7-df50-4f3d-8acc-ff3606d11cd1", "sighting--5569e75d-a5ac-4154-ae58-618e3dab86fa", "sighting--1edf3239-3bbf-4c3e-a9c1-cf8364ae1c0b", "sighting--76fda429-d6c9-4f17-82db-6f9483460a4d", "sighting--935f8829-cced-4c28-b289-18c66c4da531", "sighting--6df93d45-f0d0-49cc-acfa-06404e15ff31", "sighting--c747bb02-f4b7-4836-8379-b270d5fe5646", "sighting--9fe13cde-f848-4a7f-b68b-3b5321622e57", "sighting--4b239b8d-c854-425e-bf51-14920f3f5bd9", "sighting--a02bf14e-9aad-4fac-9997-21d7682faa3b", "sighting--8e958925-7ba3-46c0-917b-b018fc465d92", "sighting--a8361d4f-41a2-4068-a864-c2f615f88982", "sighting--6847fa02-724c-4569-81b8-f57fbd416d51", "sighting--cc5c7497-ba23-40b1-818f-801141e43fbb", "sighting--2f2c6864-ba76-4f6e-973d-b465eccbbc11", "sighting--7d7b6c39-8272-449e-8046-c3465be3b234", "sighting--58ec9b83-6a78-40b6-bf09-67fb6364bb35", "sighting--a90f448b-9e49-41cb-a45c-61e41bc1f189", "sighting--83cdd6ae-a246-4a46-812b-5fa680b3ac3d", "sighting--fbc5c595-9f9a-4b6e-be55-2ab7db1d9684", "sighting--d4f6ae58-264e-4cd0-9a85-9268d8a2c009", "sighting--f3380c8a-1e16-44d2-bfd3-9b28e69a3493", "sighting--2219b190-de5f-4ae8-923c-d85b56ff5497", "sighting--5d16600e-6eaf-4f9c-91a2-c50798dcd487", "sighting--3db7aa0c-c06a-4363-b9a8-32c32efddf9c", "sighting--adb3e238-5cb9-43c9-a2c8-e7d9f15eac7f", "sighting--ddbd0893-f513-4f28-94e9-faf14c68c6f4", "sighting--530e9ce7-834d-4025-9bc3-3ca917af603e", "sighting--911ed3a1-20aa-4c76-8a00-862e075460c3", "sighting--9391b56e-7b5d-4513-9103-e8ba413421da", "sighting--78fdfe38-afa7-4ca9-b693-ed7a9babb928", "sighting--fd1f8279-5c6e-479e-8395-058f464f5287", "sighting--de6e8e6c-78b7-4488-88f7-758ea385f3f6", "sighting--792d2a1d-2baa-49ca-8764-45676a7803dc", "sighting--c001c4a8-157e-4f7c-a6d8-b814d304b630", "sighting--5d98ab44-a949-4e8a-ad67-598cd58fbfca", "sighting--a12fde54-671c-4f00-b228-c3299488c6eb", "sighting--4ff90acb-edee-4285-b98d-4816509d35da", "sighting--575aa4aa-f858-413f-a41c-1c54d699fbfa", "sighting--49e806e3-7e36-406d-a3e8-4c6020a002b6", "sighting--b422a830-96b0-4aa1-98b5-8c32a75f77fc", "sighting--70319eaf-ff2a-473e-a59a-f38ec6697e3d", "sighting--dff484a3-ba25-43c8-a5c0-e006a99db604", "sighting--f862f1c2-da4b-40e5-a1fb-12c30baea25a", "sighting--b76a5d0f-3e4c-4082-9f95-dc9c12d0737a", "sighting--111746dc-13b8-45d0-95c7-b59a64c97164", "sighting--44b67478-24ba-4cca-8e72-f53bda6d03f0", "sighting--b6cda275-5a56-4202-abc1-b0061fc216df", "sighting--bef25f15-2d1a-4c23-8300-66df0b09c03a", "sighting--821eebba-611f-48a3-a1ed-b3f6cf5f0444", "sighting--936688b6-ed33-46ad-9dd5-4bdc5347811e", "sighting--a6ac0fe1-beb0-4280-a918-5a7843c6e916", "sighting--084cebcc-f9d4-439f-8efa-0a3168c9be69", "sighting--46f35566-aec4-4a45-9c83-a16eed775eb0", "sighting--8dd22b50-d3e4-4094-8b3e-0bde704013e2", "sighting--308c8896-61a3-439e-af95-c1e5b9a00ab3", "sighting--8fa7fe68-5b68-494c-8953-0e406cd932b9", "sighting--11371c6d-60ef-4da8-903f-a08d6f7ce03a", "sighting--401dff76-184d-419e-a991-4d903032457c", "sighting--dfecd10a-8615-43df-9cce-7e113ed6a8bb", "sighting--93654063-624e-4655-ad5c-05b0407fdb63", "sighting--f11e7f63-879e-422b-a7dd-e8311e186273", "sighting--c6cebcc3-666e-45ea-8d2b-4b82e6e41089", "sighting--3a0b6403-4a74-4725-8459-f44e20fcde6a", "sighting--50b67043-edc2-4c0a-adee-5f5116ef5523", "sighting--e5dc4fa5-8085-4e23-8d53-3fd43b9a1ca7", "sighting--966c6b5b-2031-4368-802e-c36e946e43c9", "sighting--00d7ebe5-0c8f-46ed-8499-4c2142bc127b", "sighting--6e99be95-8f16-431a-8298-eeeb22e22b2c", "sighting--f6510409-ac30-4779-898d-68caa218454f", "sighting--3fefc15c-ce29-4e33-838a-e541202cec37", "sighting--e87b49c9-7cb3-42f1-bcc3-3c76a1a53c43", "sighting--3874c9c5-e17e-456e-97c0-b597a99ce268", "sighting--799ba2cf-2a6f-4511-833d-844a39239627", "sighting--e01b6960-aa18-4a60-890d-8a7b9d182771", "sighting--e60aa71b-4008-4220-bf09-10a367715afa", "sighting--3874b000-4253-4ef8-bfac-20a255f2888b", "sighting--b8f6d152-4c3b-4d5a-8004-80f803cd7072", "sighting--c72ccec0-e12d-4520-a42b-73a38da53698", "sighting--f45edbd5-1706-4c7f-86b2-8038f73ada48", "sighting--6dd8a176-8cc8-4d63-a7c0-135028562c43", "sighting--be78b84e-55b4-4274-b243-ff6a833193d0", "sighting--dcffcb60-0e67-4082-8092-b3966c1174fe", "sighting--5a9f057d-0aeb-4882-8471-73cd82027939", "sighting--76849b6e-0306-418b-9be6-3fda5df044ed", "sighting--de7c8281-5d09-4ffd-9ae0-09cf7c6805ff", "sighting--f822b75e-372c-4632-b7c0-b32693310a9c", "sighting--328c6d22-2e28-4e34-abac-22ed4065e5bf", "sighting--7ba83d4b-7921-4ff1-88d1-83e7213c2119", "sighting--5d12b9a0-0708-4262-9890-0cb01f811167", "sighting--9b9b039a-0364-421f-aa0d-a9e65774614b", "sighting--b83d516d-0d98-421a-bc85-13ef68abc041", "sighting--2ab25916-64a8-49b8-9174-f38695c24f87", "sighting--91fa17d5-08f6-403f-8c70-136d234d9eaf", "sighting--073a1b14-9f76-4fd9-b20f-188e262b6041", "sighting--20f0172e-b39d-473f-b581-3939814389d0", "sighting--e5fc8367-624f-4716-bfcd-f2e762286399", "sighting--2ec0c856-925f-42b9-8e16-494f96904bec", "sighting--9303d409-7b86-42d7-a95c-66d3bd4b5186", "sighting--da13f440-15c0-435b-a2fe-59b9e46a14cf", "sighting--67e76122-1615-4881-abe1-a744f9d71ecb", "sighting--11edf129-1952-4090-b018-2a5e904aeb78", "sighting--1d19af8b-452b-448a-8aeb-1bc5e9c78d4b", "sighting--1d7295ce-0f50-4296-87b8-2a269fefe391", "sighting--47a0702c-5af6-4899-9c9d-63001848b592", "sighting--bf566a18-9dce-48d4-9252-cbf9baaadc53", "sighting--e6b3fb77-7124-4b50-a5eb-a5ff39d9fdaa", "sighting--365b7a9e-f6ac-4f88-ac07-4931ed2bfa2e", "sighting--8c0ae697-426e-4652-86f3-1e952489fa5d", "sighting--83b697ca-4b6d-496a-8bfd-0a58235b90bc", "sighting--3e04b261-6463-4697-8d7d-c5909fe38f10", "sighting--a65ea49f-8464-41ff-b373-403a873844f6", "sighting--b8868dab-cd25-47a7-94d5-65aaf195316b", "sighting--32362117-2710-4291-8e0f-eca0da10da52", "sighting--6a6ab361-4468-4e00-a3ea-232113fd4434", "sighting--0b594598-eb20-4656-874c-84f14a0bc3da", "sighting--af86aab3-4cb9-4f74-9ccd-8a1cebd0ff4f", "sighting--687f7667-d3b2-482c-b37b-f82902047ba7", "sighting--0415c90d-3c81-4d73-b4c6-c648adeb873b", "sighting--56ea98dd-4e88-40c3-99b9-8ffbecec1c26", "sighting--15e18b31-6031-47c4-8398-4f557bf67b04", "sighting--1af7a64b-1367-4fc0-a7b2-ffd360bc9d5b", "sighting--60f6aebb-5cfb-4f21-91ba-12aae82cbc2a", "sighting--86e93a3c-9c82-4c9b-bfc7-2bb69d1910d5", "sighting--3db36b1a-0763-4fc8-a934-3722f3e5e003", "sighting--4a94aea3-d23a-473a-83cb-4bafa78d4faf", "sighting--6ffa4701-cb1c-49ad-a7ca-bc65f204ea5a", "sighting--817e4f30-0be9-484d-a7d8-d24483c7631f", "sighting--82bf83b7-7b6d-4296-bb8a-eafec3a8eb79", "sighting--af8eae2f-ee5d-4063-a35c-4fc5eb16c8d8", "sighting--fa9309c8-e9c6-494b-8ede-6c2339ddcf5d", "sighting--e67bdb27-c7e6-426e-baf1-669a61481e06", "sighting--5d70c958-0b9d-4830-a507-03e1973dc940", "sighting--93cd2066-93b5-462c-80d6-ad41d43530b2", "sighting--42a42329-ca51-47d0-b9a3-c119bf330074", "sighting--9a68567d-7098-4dfa-ad08-704bf505bbc4", "sighting--0c77e926-4a51-4406-821a-b673e76c9b4c", "sighting--b0088bd8-2d56-44bc-95d5-9e5207ad1c00", "sighting--daf20a30-41e8-4d5e-8231-9e5f488fc36c", "sighting--7a1dbebd-070e-4c92-a927-a7e762ceab6a", "sighting--945c9fb3-e54e-4ebe-893a-6ac3351663c0", "sighting--4bdb9467-afea-4d2f-929f-f6b42ef21f34", "sighting--d27e0044-abbf-40c8-a712-84fb26e4f771", "sighting--15ba5d29-fac9-4e13-a94a-b2c8c3eadeba", "sighting--c6f43b1b-43b1-4b16-bd5d-89b07c7ec7ca", "sighting--a1b335e4-a779-497b-8728-af0904cd643d", "sighting--9e76a3ab-ae01-4b8c-acb7-3c5602c0530c", "sighting--d488c87c-dde6-46c9-9035-abb543d54c0f", "sighting--0f3d6c4d-7fff-45d0-9401-4ed6dfec006a", "sighting--4c20fd4a-52be-4d5e-af3c-f5bfa6d602b3", "sighting--d19530b4-ec8d-421d-8a9e-6c350a0f098f", "sighting--beeeb317-1d33-4503-a75d-8ff71cddbe3d", "sighting--38f85844-117d-4e1e-858f-14d70971b84e", "sighting--e0ff8326-7387-47cd-9b83-610c33e2417d", "sighting--aec55108-962a-44da-adbd-d72808e236f6", "sighting--0e2d062c-58c4-4540-93bb-0f4aec9857e5", "sighting--3cd5aa60-4a41-495e-afc7-eb8f90e5178e", "sighting--e9c62f35-e8be-44c4-99bb-84d9a6191427", "sighting--c85a2687-c1db-49b2-b89b-1d11e6c4ee2b", "sighting--a871ab26-0e1a-4c51-ac38-0f3b739cfeb4", "sighting--71c98991-5fe1-4e61-a4bd-c9ff9bb0d87b", "sighting--8d6d52bb-6010-4ac1-88cb-7554cebf83f9", "sighting--6ddfcefa-f1cb-49d5-b7e1-7f691512a5f4", "sighting--1d95c097-b266-405b-ada8-d737f3f247f4", "sighting--bd2b8d4c-9e9b-4b97-8c58-2b821f3daf90", "sighting--363d1133-1591-4955-b76f-72417ff382fc", "sighting--0c92d5cc-bbef-46eb-a53f-4ee838c70d8e", "sighting--18a9f6f4-bdfe-4441-b631-ebd16aef4e58", "sighting--d39a1e35-6f78-4b8c-9f7a-c8326571eeff", "sighting--3494b78f-6b5a-4bd4-b61a-24564f51e633", "sighting--35e15268-871a-4323-8d81-a746f593394c", "sighting--5019b547-d195-4eac-8754-50e262ae1bae", "sighting--0749f5ae-7957-499c-abbf-41605f980815", "sighting--334598f0-1d74-4799-a3b7-520be200da2f", "sighting--9e97f29a-b9ed-4541-bfba-26b33b2a06f7", "sighting--4090323f-49e8-4557-ad85-ac92fffa1a33", "sighting--28ea456c-94c2-4eb0-8211-980916a8897b", "sighting--5d6872de-de56-4f88-b1eb-c1e93a1e2a7f", "sighting--548b5e40-6ad9-4a67-8838-c2fe6c882f70", "sighting--7660323a-58ba-45d2-8848-8b6ff5403f8a", "sighting--83928930-1515-4bb9-a1fc-0842a4ffa9b4", "sighting--660b0ff8-ae43-4372-86ff-395e027127cf", "sighting--95414cf8-fcf7-4a02-9fc6-82e5761ef061", "sighting--0e8ad5ae-4eb8-42a2-9f4f-ef744f2ec07b", "sighting--ce2c70bc-d6b7-4b80-875d-effe89ab8216", "sighting--1c5793cb-ecd9-4769-b6d3-7de5c9008ebc", "sighting--c4b5e758-6a47-4df3-8afa-b0cf1af8d687", "sighting--12b6e78b-e756-4fdc-8800-fc67faa07877", "sighting--e5f51b10-e015-4bf8-83df-acc5ebc93f5a", "sighting--c339c7db-1c3f-42c6-aa71-606a4a87e8e3", "sighting--b728ac4c-69fc-47bc-87b8-b2210b8738d1", "sighting--fcd71004-6982-4060-9ce8-5a8056bfbb46", "sighting--0d4a2b71-eb59-48cf-9837-7e267b806abe", "sighting--05aa3c2b-c1d4-491a-a526-a8443b24709a", "sighting--ac86ef51-111e-4262-a750-5cf8d7823aa5", "sighting--6e80ad06-b36d-42a8-aeae-4ed339062d97", "sighting--7d5288da-9c46-40f5-9a47-f397a1a92503", "sighting--460584fa-e936-4227-8cfa-cbcb9f0856f2", "sighting--bceffa9a-42de-4e82-9302-cf42ea2b8355", "sighting--028a82ba-10ec-4342-bac5-987add397f89", "sighting--301e2fb0-9f40-4e05-8faa-5d0b7e068afc", "sighting--11a9aea3-6e0f-4bc0-9845-5be30c048bc8", "sighting--ae1ca5b8-373d-4342-aed1-1bd4d3e19fa7", "sighting--47f91b7d-d97d-41d0-931c-faf65cf5b8f1", "sighting--91f25f60-7c57-4904-8b1e-e5004ca2f51e", "sighting--2c3d5951-381e-4541-b37d-824f89435c11", "sighting--aaf96fd8-7d38-4e5c-9b69-1c68a38374c3", "sighting--4d0def80-43d6-4423-83ec-00e069a35eba", "sighting--43c22f1c-a074-4e76-bac3-4fcf144b9dfe", "sighting--93eb5c79-66f9-426e-8c71-1545683811d8", "sighting--b0eef210-12b3-4e2c-b1c4-d3828ea7d5f2", "sighting--e955897a-2afe-4385-86bd-523a9db630d9", "sighting--7805d786-60d7-4d60-befc-f07788b72b65", "sighting--bb5b12ad-6d2c-49a3-8a75-4e007d42c92a", "sighting--cc44a553-b121-437e-bea7-a280770e8121", "sighting--502cc65d-5303-45b4-b3d7-2a1554b2e21a", "sighting--f0ae6187-ab46-497f-acda-a8bfe24e1fa6", "sighting--35539e7f-5519-48ea-a2e2-c1daee7789aa", "sighting--0f6a1570-a631-4c3c-b05b-fc74f1a9199f", "sighting--39182664-3608-4de6-99ad-ddb3655575d0", "sighting--8a5c9cbb-e8a8-42d3-bc33-66114392f9e8", "sighting--6e336ffc-9286-4d69-b6b1-78988f8e6947", "sighting--c5a7fe23-e9ab-4d6b-b8f3-87e0c3204bfb", "sighting--9a16c1a9-c077-4025-8fd9-25adad641442", "sighting--84c88d6e-1333-4d17-b6b3-50bd414b2c3f", "sighting--31df6ac1-ce72-47ee-b01f-bd22abec01c2", "sighting--20ce3c5d-a555-42fe-ba2b-5424c12758be", "sighting--3356abf2-d907-4442-b194-72e042deda11", "sighting--2cd5922f-f732-489e-a857-5cf13ad64265", "sighting--122d4917-8349-444c-9b48-c58633b9dbcf", "sighting--129e1d92-b492-461e-bb13-c1c40c9270c9", "sighting--dd6460a6-537a-4385-9dfa-f0c114829ec6", "sighting--0649552d-a816-4682-8286-2efdf76fb5b5", "sighting--a7fba285-d3c0-4770-b974-21237ce7e1e6", "sighting--4c6e290c-1e9b-4a7b-9f45-a39cb1832211", "sighting--55dac296-7aa4-4fb9-9e10-990d5005801e", "sighting--ad303955-88a4-4e78-abbc-64c51ed947a9", "sighting--608b2c9b-adb6-4790-9c29-dc77aa9e5140", "sighting--59645115-8c09-4d49-9cbe-3b38d8b66dfb", "sighting--56588a65-2ed7-45ac-bac8-a9267ae6a259", "sighting--c163c7b5-7a9a-4161-a259-38a4ba3b7db4", "sighting--3dd9f5f6-788b-4c7e-9bc9-0aaeef6a4054", "sighting--fc2dcad8-f476-498a-a30b-634d904053f3", "sighting--16b86c14-0665-4e2f-8b22-908b12fcd827", "sighting--4547fbdb-0948-4eaa-9d56-f0013e010079", "sighting--922ce036-5dc4-4de3-817b-48d4046d9f96", "sighting--02a9f8d9-171f-44bc-80f4-2e6082a0c6f4", "sighting--02625494-f3f9-4df1-bcdd-2a7783de7eea", "sighting--b14d9e6d-dc3e-449c-b9b7-b49b8128ab54", "sighting--a01b31be-713b-4809-b63b-5a7daec5b11f", "sighting--ebff1795-5f21-476c-b299-6ee0297d31a3", "sighting--a0be07ef-934f-48ea-9f6e-3b4ad0f345eb", "sighting--dc91ca71-dca7-4690-bd11-1ad39d867a33", "sighting--e3469c51-66aa-42dc-a6d7-3596fd402510", "sighting--bd3472f3-4d03-453a-86e8-755a8e10b359", "sighting--290bac2d-be78-4ff5-a003-7ff5d162f10c", "sighting--0fc436d4-f0ee-48a5-8373-ee46edbb4f22", "sighting--16cc7923-b2d0-43d6-ba27-937342fe2876", "sighting--e084de15-5d5c-4deb-bb6d-881a709a88d8", "sighting--94171fbe-9b4d-4907-a065-a36666f93bda", "sighting--b536a637-c56a-460c-8591-64950290a80a", "sighting--a99b3ffb-8341-41ab-b096-c3ffbc46a37e", "sighting--5ebeb40f-e08d-463c-b94d-959b71f82108", "sighting--aa2a881e-3cee-4525-91e0-24a8814845ae", "sighting--ad98db48-2c49-4626-9164-326326c140c4", "sighting--6cd55a95-7066-41a8-94da-9412f837eac5", "sighting--a02e3caf-3a88-4082-bc22-0fb3191f83f0", "sighting--710d0cf0-f375-4d68-8729-2108d7d9f814", "sighting--c6e7d515-497b-4b24-80b1-5bdc07b24e55", "sighting--c81b0dd5-a8c0-4ba9-86c9-1ad4dbc9c418", "sighting--8240a44b-560e-451c-94c0-1a6906e513a8", "sighting--a8cd92c1-f844-423f-a9ae-60b8d167ec54", "sighting--9be903cb-710b-4162-864a-ba1261103301", "sighting--6b48d7dc-ecef-4d7c-a8e5-e3214f6c5d73", "sighting--c0ab66d7-5c5d-43cb-b0f5-870f2eb25f13", "sighting--221c1873-c76f-4cf2-87bd-bb34fd8bfce6", "sighting--9449ba91-44e1-4c1c-9d43-2f99c94da58b", "sighting--d7825702-95d3-48b8-a096-4bea49bb3775", "sighting--0685d9c3-41fc-4da8-80ac-0e0991d415e9", "sighting--9caa75f9-0521-41ee-a11a-b8fb9b6a8ab5", "sighting--4dee2f18-1d0a-4a4e-aa36-9abedcf9561c", "sighting--8fd21cfd-6480-4cd2-9de0-5ee9276cad8b", "sighting--21034ba0-f873-470f-b98f-06a0e895a0c1", "sighting--e3406e97-30f6-4df5-a0a6-8e53ce4bebb6", "sighting--8da73a49-7523-43b0-bd14-8f81868be515", "sighting--05f6811e-4a83-47e4-932f-7a707930be46", "sighting--9fc8c73d-a463-4737-b978-9bfc02619f16", "sighting--dc5b51c9-d8cc-4c76-a175-9cd1461eda56", "sighting--75397e89-97d2-4759-956f-9cdb8fad10e8", "sighting--e09944b2-46a3-4850-8057-1601fbfe2cc6", "sighting--b77a7745-2865-4d55-89df-8e4ad5ea68ee", "sighting--94ae4924-ac00-414b-bf2a-3537560eb5f4", "sighting--87d135cc-04ee-44ef-ad8b-4ecc837f2aef", "sighting--6f7e08ee-8bab-46c5-a8c6-ef1e5021f031", "sighting--999bf9ed-bcf9-4fb8-9c17-69b901ed7991", "sighting--a8132b36-018e-4de6-89c0-817e2db403b6", "sighting--25fee976-18a2-40bf-a1ce-ab9730c867a1", "sighting--67ee9f2d-cee5-42d2-8d08-f78c1d99b997", "sighting--d95f25eb-e87e-47ed-ae08-9854590c71c3", "sighting--987a5c8f-1821-4f15-a5aa-00d6fc141093", "sighting--54d8c0d4-1b94-4edf-b0de-a1df04183958", "sighting--91d2f88c-205a-4505-b158-ed6016c7fb39", "sighting--4168ca37-7eb2-431f-8b13-01d915a71d47", "sighting--99952361-68fc-4710-a735-f7ef79e64a0c", "sighting--d083d1c4-7fe7-4971-993d-30f5dbe4c01b", "sighting--a86e5bac-3e11-4eec-9a3a-bae0d4952a2f", "sighting--bf2ce1b9-4b1c-4a96-b6a1-665ac0a0b310", "sighting--4a930232-cc64-4dc0-8575-c435c887d515", "sighting--fd0f4b2c-093c-4088-9dcf-8c773386fe80", "sighting--07758aee-cb4a-4472-92b9-1c3ba2d55f30", "sighting--0e7b59dd-e643-458b-988a-da86f641a5ec", "sighting--3fa698c4-e7d7-4afc-9757-2946e2966377", "sighting--4e9d313e-4161-44ce-9a70-c1d0825a9847", "sighting--bd55117d-3c03-4ee2-851e-0252fd96bebc", "sighting--caf1c5e2-3bb7-4793-8056-d6c36f86e721", "sighting--621ad395-3dc0-438b-8a51-627efb4150cf", "sighting--3a94cf71-b566-475a-9cc3-c258e97d54d6", "sighting--00331b75-00db-4cb3-94b1-ef9358547172", "sighting--00e0389c-8319-42ae-8b17-af1c67ca44ca", "sighting--7271da11-35fc-4564-952e-e569dc92000a", "sighting--296c00c1-8078-4c5a-aa15-75277de94fd7", "sighting--7b9e1405-7296-4689-ab6f-edc299e432ad", "sighting--46abe015-8118-4d38-9647-76c1dd0de865", "sighting--d59dc8fe-f632-432a-a9b1-52fc92b1f78f", "sighting--e8c05a28-9b49-4f56-ba32-485f5fbff89e", "sighting--341830ef-d999-42ba-a2ed-bcb3df9b9ef6", "sighting--20220ab0-0129-4214-a4f1-ec7da32b2bc6", "sighting--74e1a47a-bd3d-43e3-ab44-975426e4935a", "sighting--c3a9665b-f19c-479d-8ec7-35c405278171", "sighting--0dec30af-c2e1-4fca-b0aa-145a7bc1b203", "sighting--a7d54d86-3cab-4fc9-8c02-9de2bdf992d6", "sighting--451788a0-06e6-4c27-8a08-d4853075ce3c", "sighting--3c955dab-150d-4114-9908-6f1b4979c78f", "sighting--bfbf6d94-2f5d-40b0-8409-96dd5bba6b3a", "sighting--ed50a3d0-0a3e-406a-aeb3-2dc2c2487d80", "sighting--e9381ec8-cc76-4468-aacd-6320b02e19fd", "sighting--df8038b6-dabf-4fc3-a0ca-ab71276bd8f5", "sighting--2e858e7c-f51e-445b-bac9-e40ae5453212", "sighting--e7817480-1e35-4d6a-9ffa-112798e1046d", "sighting--74230e95-b505-436a-b52a-4e9da06ac7eb", "sighting--13262f71-c74d-4ba6-980c-6cd8477c3b98", "sighting--e1dc1ca2-b8e5-4ab7-a2b2-1b8d3ce700c1", "sighting--6dae885f-9f08-4cb4-bf49-d6d8b1b60749", "sighting--31bdf67d-a3e4-4a2f-a3df-dde22d685dd7", "sighting--5a68f6f8-a56e-4709-bfca-fb068c81e158", "sighting--8c77ceeb-b631-4334-b048-0f6eea21189e", "sighting--a983280d-82bf-48aa-932e-f6412ad90552", "sighting--cfe7d75b-aae6-489e-9870-ed8d9b622e9c", "sighting--d7f32aa6-037e-4a27-b783-72825aac31ce", "sighting--2371e78c-7b12-4ec6-bb12-f3a61a75aee9", "sighting--1b16cc5c-3343-4735-b23c-e930ac85837f", "sighting--842bfe41-e154-4b81-a416-e6feb6086f74", "sighting--4951f4b1-4e5a-4990-ba21-2fcc19048c85", "sighting--1048aa57-70ff-495a-8f2f-439308e8acbb", "sighting--a1708f34-8fe9-4ff5-926b-e9e5a9667ccb", "sighting--34fc52eb-245e-4ee3-8e76-ddbb601e821c", "sighting--1fadcc9a-90f7-4e7b-82c8-a7a21d858ffd", "sighting--ea16a1e4-27c5-4e7e-a59e-a6791ca81063", "sighting--bf5b36b0-a6b9-4f3d-9fc3-7302e58b6f56", "sighting--20fd044e-bf07-4dd6-b560-999c8fe3d8b8", "sighting--19be7167-4f5c-4a47-bfd1-4ad389b11ce1", "sighting--405a4616-1c29-47e0-a675-0f1cca8596ed", "sighting--213b8450-5098-4962-87a4-7265c4ea4562", "sighting--bc917777-3366-4cb2-abcf-c18df3524ee5", "sighting--23d42905-8416-4905-bea1-83d7e6ac0f25", "sighting--1fb7ed91-255e-449d-87a3-3812975f1daa", "sighting--d7d0ed0b-41b2-4c16-afda-d1b0a2fc7ab4", "sighting--7a78be16-621c-4015-a826-ae44ef17ef8c", "sighting--f0b79448-e172-4e84-9847-e501b805c512", "sighting--f4b058f9-ea23-480b-a9c2-70fdbc98ddef", "sighting--6ac47e10-2c56-4657-b4f6-69daf16a855d", "sighting--38032c20-f27a-40fd-afad-ba4dd98545b4", "sighting--9d3e079a-ad29-48bd-99e9-697ff9964fb1", "sighting--d5e40e29-fb75-46c7-9a76-0085b72dea38", "sighting--285cc465-b2a0-4554-8cb1-7b3a6f563bd0", "sighting--60044478-3382-4ed2-baa8-104c29963245", "sighting--305270f8-0617-42f8-9127-ad2e2bb757e8", "sighting--fa8ce6db-68fe-426b-9099-bc4adec7b510", "sighting--4bf95cfc-7617-4f70-be21-7032a2ce44c5", "sighting--ce694153-2d5d-4363-8552-c8c415f600da", "sighting--aa06da52-9ece-4da7-a158-8f98bdcbba9a", "sighting--e179aa75-201d-4b30-b97f-4b3624839692", "sighting--5b81cac1-187c-4397-aa63-4238e7defe49", "sighting--2c22620c-590e-4a92-a4b7-58f1222497c5", "sighting--6c024c9b-0776-456f-ba4e-b334b946ac0c", "sighting--80de72a5-59be-4c43-86cf-a923db4789e6", "sighting--a83a0b86-e44e-49e8-8ebc-ab2d35140793", "sighting--41cbe469-6482-4207-bc2e-86129ba2bca7", "sighting--4d13d936-57cc-484f-a4e0-254ed8c7a871", "sighting--3e24116a-0b7a-4437-9cb8-a859c4fe4ae0", "sighting--8e2278e1-635f-4e66-bafe-5cc6450807db", "sighting--0f60809f-2ece-47fb-a944-ee359519a674", "sighting--47034e3f-acf3-4014-ad4e-5cf48f6c011e", "sighting--40b3cee9-4a00-40d3-af06-6333226df27a", "sighting--77325442-a72d-4452-8222-ddd7c2ca2b8e", "sighting--b5af0a9b-3aa0-4bf1-ad5c-0d1be9849bb8", "sighting--aa1709f4-1bc9-4db5-9e0e-15153a2a96ca", "sighting--599a0018-4e79-46b3-9795-04a5f147f4ec", "sighting--ba0e04a4-6724-43d3-9d27-de87f5f5d089", "sighting--d3012403-b921-4fb8-a60e-01b13504ca4c", "sighting--96e0c6e1-4cae-43d2-9dfb-add1a502d433", "sighting--4d1439ca-5c10-44f7-a358-cae6dede9644", "sighting--0bf50545-5094-480a-a412-1ca3ea4b331d", "sighting--41c5181c-7282-4eb8-a863-6e3548fa6e72", "sighting--2c07bd09-1ea3-4d9b-8c34-1c11a9f21f62", "sighting--21a45a76-0a13-4651-a7d5-6b356c4b4df2", "sighting--cb8dc6ed-eba7-4658-8e1e-ea759eaf3192", "sighting--a8be8343-a9cd-451d-b4c5-a617630cb770", "sighting--7273b499-26ed-4b79-8100-1ba92d769167", "sighting--551cf613-5230-424a-b16a-edf3d6f6ac92", "sighting--9f679880-b262-462e-a656-c5b6a5f1a092", "sighting--2f022694-25fb-484e-8063-0973108850cc", "sighting--7509eaaf-164b-46e5-a561-dd090dd6d3f8", "sighting--3134e0f6-0c56-43fd-a80d-81e192d9d4f0", "sighting--df2464b0-2a53-41ea-a885-c759e6e22519", "sighting--cc91494a-942a-44a9-adce-54adb7228486", "sighting--78228e9b-c119-4b03-9c6e-0d206892f543", "sighting--12b105f0-e5fb-47b2-b93a-85fef3fc1b8f", "sighting--47a2ef22-6ed5-42c6-961b-816c98e63e55", "sighting--9f3a1ce3-244a-4e14-9c5f-1f019a8d751e", "sighting--14d197ad-9f23-4a21-bd64-0e81f592bf06", "sighting--6b910dfc-9abb-402c-96d8-b750d434db62", "sighting--962ae60d-e897-472a-bb43-15e811777a82", "sighting--45b0693a-a56f-4a47-aa02-a7d0d81a6582", "sighting--7e889b1e-78ef-4ab2-a011-55220aeaf3c5", "sighting--2fe5a88a-b615-4787-8161-b07f34764bb1", "sighting--c838f434-f375-4ac0-bdf5-3a15b830f04b", "sighting--bf1acf55-c5cc-48ad-985c-a6fbb6a87976", "sighting--7b628547-fc1f-4156-8bc4-c462c4fb8696", "sighting--1ab917cf-5484-4e55-ba27-33339a6bcdcc", "sighting--1d5512f3-a549-499b-b2d9-efebe75c4282", "sighting--f4fe1825-2c47-4b11-9459-9af5e1bbbbf7", "sighting--dabc977d-2222-473d-a06c-438e11c2f964", "sighting--aa65beed-4935-4b6f-8c3e-7326f65568ea", "sighting--47bd56d6-a2dc-49ed-95b9-b3988df8c813", "sighting--af821135-7200-407e-9c10-35dcf8c97a6b", "sighting--577abf53-db49-4c04-8700-15971416cf43", "sighting--de7b70c2-9e2e-4b6a-80e5-3d785dba5c83", "sighting--4f3722f7-759f-4302-8391-70596b0056bd", "sighting--05b12fda-9fdf-4221-b8cd-32ac6a8f509e", "sighting--e513ecd1-7b17-4751-b57e-cc48430b02ba", "sighting--01390706-fa1a-4b07-9998-4e080b20d52f", "sighting--b904f9c5-3ab3-4129-8ae6-0f0ce6d42845", "sighting--da1dd386-b6c8-4ddf-a0dc-1452b165b848", "sighting--3ace16b4-e54a-43de-a269-076aa90f171e", "sighting--ff39d9a9-0389-4182-bd3d-6be4d860a3da", "sighting--a9bdfdb3-7ee3-4d38-a179-0ea643fbd702", "sighting--41a17ba0-b78b-41d5-a6e1-a0a015bd290f", "sighting--21aa0ce8-a82e-4bdf-a653-e5c94e9fd217", "sighting--98c6ef9a-84b5-4b75-9cb2-2d3a259ac650", "sighting--2a58228f-0018-4662-9c60-4eac79172cd7", "sighting--2f0f6942-f2b4-4d22-a53e-aef4549459e6", "sighting--7a91aa8b-0f4e-4e6f-a928-a29fef7cf629", "sighting--e1ddb816-3380-4ec5-9293-1f67371b4cdb", "sighting--e43eae90-32e6-44ef-bbb5-6e5e06f291d4", "sighting--e2eebae4-aec1-4f2a-b94b-686681e8cd21", "sighting--7448bdbe-b0be-4b39-878c-99c0b446169a", "sighting--5e925d54-24d3-4b53-a09e-3cc9d56fb52e", "sighting--459034c0-fad3-4079-b0ce-cd897a456294", "sighting--f007e4a3-fa89-4fc0-aa97-1272ca5499fd", "sighting--be087692-f429-4c92-a057-f205f8fc01c3", "sighting--d66f6f76-540f-416c-a100-7069065d67a1", "sighting--4b216195-f9c6-472d-bc7a-0d9dd4a7dfa6", "sighting--d2aebe10-0724-424e-adb1-4a7b9ff4e6b6", "sighting--b54aaedb-37a2-465c-93c7-63ad8ec9820d", "sighting--a32e0e5d-8e4c-4e71-8053-0243a2ae18b7", "sighting--4bf194fb-fa66-4c0d-b5c9-83b9b5380001", "sighting--42069165-8c7c-44e7-bf44-3486deca24f4", "sighting--a19814ab-616d-408a-b568-2dfeff417929", "sighting--457b5701-e840-49dd-9e85-c592e0bab8ac", "sighting--adecfe60-fd8c-4a0e-b668-7a3eca312d22", "sighting--fbdabe66-3995-49ab-9592-86b00ecf6832", "sighting--b363cb63-8095-447d-9b68-b6b7b3181774", "sighting--4c22f4eb-c3e6-41cd-8bb6-c409ef6ba5a0", "sighting--d7a4a639-5f42-417f-8769-35d0e7f674a2", "sighting--d21242f6-bd0d-440e-a088-f8690da414b0", "sighting--f4bd124d-8f68-4403-890d-32ce45fb59a6", "sighting--5cc1f093-702c-415f-b465-435a573d9c2f", "sighting--2134d37e-3ef8-4a81-9ce1-84a8b0bd4a4e", "sighting--1dea5f7c-b42d-4b23-8cc1-d1540441548a", "sighting--7d84734c-0a2f-482c-97f8-bbf0da961f6d", "sighting--68e7533c-2d27-429b-bfd1-4b793eb258ab", "sighting--7ac2839c-4fcb-472a-a705-7b02e9ed0372", "sighting--5ff4dc20-cd98-42e8-8e76-ed28afb7c9ad", "sighting--250033be-0f2a-4e9b-be24-f84e13ef8f87", "sighting--48cfbc4d-eda8-4db7-a721-df5d24544e94", "sighting--234efe0b-dd2c-4ee4-8060-bc19895970fd", "sighting--6332c75a-9abf-44ba-9b87-c2a709401fbe", "sighting--9f0a3370-1574-46eb-bb4c-a7e0f798e3f5", "sighting--f4b6a86e-be0a-40fa-b835-f7442a2ec6f8", "sighting--35868e4b-1f68-4b82-a033-9206b7407429", "sighting--a273345e-c056-4399-9867-49a77981814f", "sighting--a8f1161a-0091-4e73-9430-7aa027e863b1", "sighting--5f6d8a7e-80f4-42ef-aceb-ca6885c65c68", "sighting--5632132e-40e0-4ed4-9f74-ec15772d15e3", "sighting--68fe35d5-5b80-4b42-9e18-514dd021300c", "sighting--91ea4138-ef3c-43a0-810f-55b6d035cd1f", "sighting--182ea1ac-0b77-4dbd-911d-11659b5f65b2", "sighting--1be17fd9-4368-42df-a617-2363cbe97f9a", "sighting--6c85b1a5-afbe-48d2-aa27-e99cc77eafd4", "sighting--860ad848-e6d6-4c2d-9869-d9fc01292fff", "sighting--597600c1-376b-426b-9093-f72ea1456db3", "sighting--d0de81ac-f7c0-4ec3-93f3-913492dba6cd", "sighting--e50ceaa9-baf8-4b69-934d-3fb1b28e6e35", "sighting--5c2ee6f8-aec0-4782-a02d-b8cfbc9d69f9", "sighting--eefbf37a-f1e8-4c0a-aec6-b2c36eeb091b", "sighting--71629ed8-de57-4a41-93c3-7a16c0246bd8", "sighting--f6b215b9-73ee-405d-844f-0f94283e6e5c", "sighting--1bb557e7-59eb-4754-b34f-7629553a4a42", "sighting--6b82a0a0-85a1-490f-8720-d9c782247412", "sighting--ec919d04-c08f-456e-abff-7081bc51c091", "sighting--0d6e27af-912e-4251-be0f-93bf3e09332c", "sighting--8dc8ad20-c392-4f42-bca7-6ea9abccf57d", "sighting--a3e7cd0d-d554-479c-9989-eacd75a81f37", "sighting--ed695a4c-ccaf-47cb-9c68-747173d38b4e", "sighting--d55c8028-4706-4b4f-8e8f-2e7f680c2cad", "sighting--751f2df7-cdd7-4057-a4cc-701a0a5efe48", "sighting--3bc7ebd8-1a26-4b56-a715-10d027918e33", "sighting--bbfa0182-bce4-41a8-ba3c-93b1400bece8", "sighting--84528161-61dc-4118-87a9-31b9ca412d66", "sighting--d869f722-7f54-4c1c-b651-0b104c4c9e3c", "sighting--8b0e4a9a-f1c6-43cd-8dcf-fb07152b93c1", "sighting--cf44d78d-6a78-4a0f-9dd6-55f182635199", "sighting--7c0c85a6-8c7b-410b-8aa9-10bf3abebe6a", "sighting--fe8ea259-25c8-4f18-a0f5-221a3a0baabe", "sighting--968ef9f7-8741-46b7-ace8-78f8f4c880c0", "sighting--e27ef4fb-1361-4817-abe6-13150267bd76", "sighting--0d7499d9-c0aa-4997-827e-a00bf215a1e9", "sighting--3b6d5325-c1b2-4277-a6b7-35e6ae4f13ce", "sighting--5e763095-e6d0-4a9e-ae74-b1b3221f7810", "sighting--d5df693d-a2bc-4b0c-a215-c43f2b8ac81d", "sighting--dfed7b3b-ee36-44cd-916f-4cb39c8c24ba", "sighting--8ab0014f-1b01-4b6f-8ccc-1cd4bd00a930", "sighting--f95b88fc-507a-40a4-84ef-f2fd75e9a29f", "sighting--1184112d-04a8-447d-90ef-51db603da93f", "sighting--ae0c2d78-695f-4414-9acc-50c30677305c", "sighting--f4cab31c-2e30-4c2e-9fec-ac34db567110", "sighting--ceca151d-3048-47b5-a5f7-94db27f084d2", "sighting--8667b47b-288c-4050-98f1-27ccfbb990e9", "sighting--b531de60-0290-49aa-a345-398376556620", "sighting--e0f985fd-f08c-435e-9e30-4a15070e938d", "sighting--e66332fe-70f6-4499-8909-1b0648d07292", "sighting--422f6a25-f307-4d11-bfe8-ecbb87c4a1ee", "sighting--40301d6e-6789-497a-a327-d5aaf6eee7d6", "sighting--ed48b1cf-64b7-41ee-980e-da36921c2ecc", "sighting--06307de9-024d-44d5-9044-a9b92624faa9", "sighting--c4ad9bad-6574-4a9f-a8f1-8db4a0402414", "sighting--706f90ff-81da-448b-8d0e-36db08886f0a", "sighting--a00689f5-722a-4584-b419-302ab30d8688", "sighting--a9af6638-44e4-407d-b2ce-c87e5b310ec3", "sighting--3f9c8b33-060b-4ac8-a166-88bb5f35413f", "sighting--eb851666-f06f-4b29-8532-5e7ff1a3d046", "sighting--272e5fb2-d0cc-44f1-8bea-d126b8c5373f", "sighting--b0db34fb-c813-4f80-b481-3d50f8551bb4", "sighting--6680e455-6c8e-4dee-9903-16b77b9328ad", "sighting--1e7b7225-dd92-41a7-a42b-e15a02e63863", "sighting--9f48577a-b797-43bd-b2b7-e99e4d679bed", "sighting--c8e2ffb7-c2a2-453a-876f-85d98ef36acc", "sighting--f21082df-ef27-469a-81dd-ff074f478aa8", "sighting--83a9410d-978d-4b43-9b62-c50a5a47f184", "sighting--1c977e93-5640-4e55-b324-f1c234bf062c", "sighting--778bffc1-4241-4764-b19a-078b8735cf7e", "sighting--a6a35eed-33c0-4e15-8da2-40534b666cf4", "sighting--590772b1-b38b-438f-a994-88ba18d87905", "sighting--37720a36-ff85-4853-ae17-fa2d17c35e8a", "sighting--a226f796-113d-4bd7-9925-c682764d934f", "sighting--8a2c3e2f-9909-4de8-b3bf-8bba1f64629b", "sighting--74243ae7-6713-42a7-9428-096ad0085d30", "sighting--58220ccc-5f42-4f04-ba96-f9b8239b71ef", "sighting--f40ff733-018f-44c7-8155-f7dcfb7e30f4", "sighting--5cbd3312-4c67-466d-94c7-9719fe35eaa7", "sighting--8c6821b9-1afa-4623-9fbd-2b7aacceffcd", "sighting--cc667016-7894-4f5d-9f04-3417f0364ea8", "sighting--a484af81-ffa4-48ea-b8bd-37c635180924", "sighting--65ae62d8-81fb-466d-8ade-16978b8671e3", "sighting--d490cea1-fdef-4517-9b21-b95ef1c36f86", "sighting--0a229a42-4e48-4dcd-98a3-7ce4b0902adc", "sighting--254a1d09-6703-49b2-b055-ce979bae5226", "sighting--cb431ed1-ed8c-41f1-be2b-05eb436dd63c", "sighting--0a7439e2-aa10-42a6-9eec-148cda99bb1b", "sighting--dc36edbf-c81b-4a3d-976a-09242f2c3802", "sighting--077092ea-5e3b-4e35-ba4f-8d26873674a1", "sighting--3dbfb5ae-063a-4f65-8cd2-d4ec8b3dd754", "sighting--9996b337-624b-4933-9b5b-0faee27d1c2e", "sighting--0f2c5437-cc99-4024-a960-aacef662bc57", "sighting--cfbe0844-f144-4507-b6c2-e2b8fb5eabad", "sighting--79f93413-471d-4292-a981-b53f0d0bea27", "sighting--aabdb998-9d7f-44b9-81e5-c1a77345b483", "sighting--6274dc6a-e70a-4abd-aa1a-fe8b70987870", "sighting--ac3e6ae8-2c69-4176-8445-a87d1f04af4b", "sighting--99b2afc8-994a-4a35-b9ee-31243b490e10", "sighting--0a9c7cae-7aae-45bf-bb2c-69d6da2c09be", "sighting--3c0902df-3e87-42f7-949a-57af3a14a3a5", "sighting--86674bfb-6810-46d9-ab22-f86b29085415", "sighting--701277ff-51c6-409a-bb17-11d99d0f55d9", "sighting--761270d0-d335-4d00-b68f-9a58c9a4d98e", "sighting--0b6d788e-9e78-489f-875c-163e56ff81a6", "sighting--1d14b69d-7948-4d2e-bfcb-5141d61b92a0", "sighting--cd1d3537-81ce-4c13-85e6-ae171e25d06e", "sighting--960f2b33-2d3a-4e59-bc95-cd5f05fe3788", "sighting--fceb69f0-6d84-4342-b483-d8b72e9e2d5c", "sighting--73c59c49-db34-4b3d-b0ed-9c864c1cb7c9", "sighting--d9f6e813-d0d0-4887-976e-a2083884a0a4", "sighting--9ba93d21-b929-4d94-a04f-a07050053806", "sighting--1d9333b0-da5e-444b-b280-0ed48ce6bd45", "sighting--1b1f6cce-adc5-4c53-acc3-42107355ee46", "sighting--0eea3783-6c57-4613-8611-9e7e84f170fe", "sighting--2e44dad0-e950-4242-b5a3-071000f6bbf6", "sighting--9c60d5d6-8fc8-48e8-8983-a673599f80bd", "sighting--e05e96d4-1125-41b6-9356-70f985280193", "sighting--b81f51b0-c165-48e9-9bf1-17420aa73092", "sighting--ae8915c1-1f0b-46ab-87d4-39b6d82e5264", "sighting--6a4a4398-ade3-478b-b08a-e77289c2bb7c", "sighting--70d0021f-96a1-4988-a27b-9eff47704933", "sighting--87979f49-8372-421a-945a-ca46f521fecd", "sighting--97939b14-25f9-481b-ba0e-7f09bd54bdd7", "sighting--5951a61e-03d0-4efc-974b-fab9adec8a5f", "sighting--8b7e02d3-d52f-4f25-8159-2f7e6edc3a48", "sighting--ce76d90d-e819-4fa4-9f1c-856f13c9548b", "sighting--1ecacb93-d6a7-4a2e-aed0-214f3a5151b8", "sighting--16a19137-6995-475f-a574-0baaf93c4fb1", "sighting--5aea82f1-1dfc-4fbd-845c-d50f4db503a5", "sighting--4d03c028-0438-4db6-9804-973f2db8c3dc", "sighting--dc98041f-b589-41c1-b302-687b22a296ab", "sighting--7ea685a7-f2a3-4438-8f31-6ca06f127146", "sighting--836884de-fc90-4803-b129-c3d661014cae", "sighting--6f88d115-0ced-4cc9-bf88-98b96b37f6b3", "sighting--caadfe78-2a46-46fe-9719-907da51ea443", "sighting--22f36282-a6d6-424d-8d93-10ed5b9eb77a", "sighting--43464e70-13d8-462b-9e53-16392b3c0245", "sighting--ed34f010-ebe7-4c7e-ab7e-c7c6e3e6ac77", "sighting--10bb52b0-fcce-4e6a-b1a0-ea8c2326d9ff", "sighting--3888b329-f1cb-45af-bb01-b16c20ff1e1c", "sighting--86326882-af11-41bb-ad22-aa867fd05234", "sighting--38acd1a0-a048-4e4d-b1c1-dd13b4e6f7a9", "sighting--1b703a74-2fa0-46ea-b220-6fd6aed8ba9d", "sighting--cc00d19f-986d-45e3-9e85-0b2ba8c404c1", "sighting--1b7c460a-0d22-408c-9e35-92711bd347a5", "sighting--9d2af903-306d-4a44-8ce0-a3bf1fbadebd", "sighting--6f06071e-37ea-4d35-b7d1-6437f66c6ffc", "sighting--e0fee35b-4ee9-43eb-b98c-4504d2e51b4d", "sighting--2ed7b394-ac22-4a93-84c8-316039b815b8", "sighting--d26c2387-569a-4e2b-9a47-60f7b33da53f", "sighting--df519ee4-4917-4542-9b93-6679cb490ba8", "sighting--c4495667-1384-4019-b5b0-91e1157f44ab", "sighting--defe9490-331b-49cb-86a1-965e77421a6c", "sighting--4afe5473-cbed-4d7a-b8e6-2c51c1503daf", "sighting--ee22092d-b455-450e-82c8-9355b83b89aa", "sighting--bf53d285-9163-4a26-8e97-fde5a16f2513", "sighting--365086a7-756e-4bb7-8dda-5f0a476b5010", "sighting--a4cdadde-b18a-4b44-a285-c982fe97273b", "sighting--98d72023-1829-4c04-8725-69e382af2ec3", "sighting--6d5f7665-0b80-417b-b4d8-365b0ea6b34d", "sighting--820c6810-a236-489a-821d-4e84bda6caf5", "sighting--fc730b01-8671-484d-adf2-84e0dac605b1", "sighting--638aea8c-014c-4d9f-9c95-45b5556b1b3f", "sighting--849fcdc4-7b7b-43b8-a42f-3aabd5179096", "sighting--4cd8ca4c-9ae7-4a6c-827c-f0aa3d54eb0b", "sighting--5163d064-2c54-454a-b39b-aed337815807", "sighting--513e2dff-769c-4df4-858f-548f183856e7", "sighting--c06a1bc0-c114-438c-96da-611ba2fe0ae8", "sighting--866c61ab-cb1f-43ec-9234-6107e2d15484", "sighting--2debd8b9-12a6-434a-86db-5126671b440c", "sighting--7dfb9a46-0fbe-4445-b07b-5e900933b9f0", "sighting--0d803f48-f71f-4ab0-91dd-fe2764533cd6", "sighting--a2276643-e0e4-42d4-83de-705539886dc0", "sighting--3082afc8-cc43-47b5-bb21-902506552de6", "sighting--fa7b3849-ac2e-4fbe-9418-3fc389d205e2", "sighting--864942c4-1e59-4c8a-8d83-e98f7f8207c7", "sighting--833c8bb0-b506-47fc-a3af-b80a9235294d", "sighting--f779342b-bb56-4521-abd2-ba56d395dcc4", "sighting--99aa3d5b-d095-4c90-850a-f61aaf08c5b1", "sighting--d12ad7d3-ca73-4807-9f29-9ecf7e1c9ca3", "sighting--304997a3-3da4-4a38-ae21-a5dc4a3c6af2", "sighting--dac08b8c-f503-4e5e-b4f5-46154e72fb22", "sighting--1d983235-defd-415e-b3d6-c51871510316", "sighting--42a9dbc5-1361-42ab-9106-0f0354d77700", "sighting--b7c30c80-423b-4af0-85e2-4954a91228e3", "sighting--537434f1-056e-4562-9e84-830de20223b8", "sighting--eeb37e25-a876-4463-a582-58d30fffc341", "sighting--633d5da7-8b99-4fb9-9126-f530a78b2419", "sighting--b26798e2-9197-4b2f-aba6-d9b1fafacbcb", "sighting--a12d89b7-e369-4d0d-85ee-bf0023c15f72", "sighting--07add4a8-40c7-4539-9015-a401f60430f3", "sighting--13688bd5-c974-419a-b60e-a59883d6c796", "sighting--f9a945cb-9f4a-4918-aec4-99ed1e3ef664", "sighting--0aa83eb4-9baf-4523-b402-d28df265aa53", "sighting--768c01ab-1a29-42bd-91b4-9912bd50f3b9", "sighting--1eefc7b0-78ae-43b6-a151-1a19f451eb40", "sighting--d47fefd9-f783-4c76-958c-645df883fa9c", "sighting--c6c82e06-3627-4dd1-a8a6-c86b10e02cb5", "sighting--d81503ae-5c83-4e98-9bab-45a1eb8348f6", "sighting--494954b5-e4bd-4789-b338-0a1c35a862ca", "sighting--d05ff6a7-5705-4be9-aef5-0cd105e067d1", "sighting--89fd9daa-6d38-4711-8cb8-c1b332f4b57f", "sighting--e9793372-231b-4965-a587-24e1d080b663", "sighting--95c13478-fb2e-4ba3-ab6b-e9ebf7b48a07", "sighting--44aab46a-dad9-4c3e-8cd8-882089f9e528", "sighting--356eda01-fb74-4272-b73e-aca819e486fd", "sighting--49f831ab-0b05-48c6-8653-07691f09efbe", "sighting--c30d9d7d-b043-4115-8850-b2c9e7b62832", "sighting--9adc8534-c4ef-4854-bbfd-f76806dc4b63", "sighting--ff0c1b9a-b913-4949-ad5c-f70d9103a1b4", "sighting--d0e5e959-3118-4eb3-8136-c54e82bd44fe", "sighting--25b8a660-9507-4d7e-a137-c281176ac274", "sighting--0da55589-6b58-409c-8ec1-1139670ed7c2", "sighting--c373c8c4-02cc-43be-bdac-1b7ca1784ade", "sighting--b6493a08-5fc1-42bc-b440-08c136ccc3d7", "sighting--563e87cf-91d1-4a10-bd41-a1fc6041bda9", "sighting--5bad3fe6-20a0-4ef0-abf1-616819dacdd8", "sighting--28bda81e-fbd2-4c9d-b241-7eea78d0434e", "sighting--d451240e-7044-40da-9ad0-b5eaba4188ff", "sighting--55705c54-66fc-439c-9189-de4389cec158", "sighting--c5af47ec-debe-47b4-8eb7-cbd1920c0637", "sighting--c2d7d2e5-b577-4c34-ac9c-90428e486ca4", "sighting--7de52bf4-5ac2-4d9e-a84b-e018edd3de2f", "sighting--35c95047-3eb3-411b-93ac-9b07c71004da", "sighting--b97cef06-5d2e-4cc6-9bc8-76aab1a1bfac", "sighting--d745f787-9bc4-4269-9aa5-0c8f37649b45", "sighting--bde90393-be6f-49c3-bde3-9844b9d76910", "sighting--cceb24f8-69ae-4fd5-adb0-7452f460f356", "sighting--6a1e8835-2dc1-4cff-a2d5-1fef551468aa", "sighting--bac951ce-6605-40f1-bf2c-5c586a05ae1e", "sighting--2d9a12b2-870e-4f8f-8dc2-6f327b9a62fb", "sighting--60dc3302-a49d-466b-8a6d-89cc83d39e92", "sighting--25f09c0c-426a-4b84-82cc-3c6f538f0864", "sighting--647bac88-c0be-4acf-9f23-8ef4ce4c8c49", "sighting--0af99e3a-3d90-41fa-827f-594cba83074b", "sighting--697a0948-d0a4-4f29-8065-ec114a47a242", "sighting--c39daee3-a06d-4321-81ab-cfde8b46c44f", "sighting--5afbbd83-2aa2-4fbc-ac9f-777b1b6adb4c", "sighting--5a3960b2-ba16-40db-b46a-23eae830cd6b", "sighting--3b8048d6-85cb-48a4-a034-5d68ba81885f", "sighting--180db3d2-39fd-4f44-b4cc-12228ddfeb4b", "sighting--4dd9139b-4275-4e47-ad7f-4f5f89eed3e3", "sighting--38f0ab01-03be-4c80-aa7e-445ba1f504e6", "sighting--a3d23eca-ef47-4b9f-9fab-1ed6e531148f", "sighting--85987106-4236-40e5-a34d-e25c66da0e5b", "sighting--3796335f-5990-4c5a-a088-0cd2bcdf2c63", "sighting--dda412ef-9236-4a99-8a7b-a911321cabdc", "sighting--1784d7e0-2e32-43e4-bf54-0c8f4263d02a", "sighting--4bc48d52-3e7e-48f9-b0da-1c21bf3db207", "sighting--d3f1ae67-2fcf-46bd-8a26-13fb1b74afce", "sighting--2b2676c3-21d8-4535-b3d2-b49efef5311e", "sighting--9c7d3d2d-b5cb-425a-92a8-c2db6b4302ee", "sighting--b0b69031-b4f7-434c-a9d2-63172ca6b104", "sighting--399ba29c-c52a-4712-9a1d-fc4b5e55e297", "sighting--07c8f336-66e7-4f18-8447-45ce4874d4d3", "sighting--ebd4f620-32ac-4944-abdd-71ae6e0da990", "sighting--d001eb18-c2ee-4980-9d9e-3f02fae8be6e", "sighting--4aa85307-3099-497e-a31b-903e3cb3e5ac", "sighting--b7e86540-6fce-43ed-9d1b-75bec1e5c999", "sighting--4df47b45-aba4-4427-a555-6870129b5bb5", "sighting--8e8283c0-3c1d-4a36-abae-f65e6d3e972b", "sighting--cfec835d-794a-4211-ac9f-c77c98be4b16", "sighting--0369d0c9-998c-4a07-b095-0bb0b0384dcb", "sighting--4b4113ca-8341-4188-8539-739cd0394dee", "sighting--2233e4c5-007f-4e87-8c96-c24a5e34e160", "sighting--9aa22dbf-f2e8-4282-adfb-c63b1b8db79f", "sighting--1bdbaa38-64b2-4833-b3eb-53da86321092", "sighting--7c3aeca8-3870-4b7e-b18e-95be6c37e324", "sighting--21489943-d564-47ba-a688-d19373c6ef61", "sighting--1d8ca6f0-98eb-48a9-b98b-b86b3b5707f2", "sighting--8ebd3856-87f8-4c34-a651-4b12d4d98eba", "sighting--c2dd3801-7338-42ae-b062-bf8be320b7aa", "sighting--4410529b-25c0-4fcf-b3c7-ade356f6bc0f", "sighting--f9c74cbb-cca8-4e46-bc19-8fc81b7eae8d", "sighting--0cf01185-9f1e-48fd-b2e9-5de2ac877751", "sighting--58a511c4-cfa3-4c29-95a2-0a0a4fe7a23b", "sighting--9296a820-51cf-4d33-aac7-8493cb03642d", "sighting--c2e42dd0-1525-492e-a7ca-72cf26f5fad4", "sighting--42f36d0d-3d34-4e18-bfa0-c7ae1775a8b9", "sighting--edeec098-27e7-4db6-8b8b-af1c95db19c3", "sighting--158fb796-8ac1-49ac-a10d-f7a1e07ed40b", "sighting--7a88cc28-31aa-4049-a36e-21ff6df64a0e", "sighting--60e5dc87-90ef-4763-ab1b-6caab96ee13e", "sighting--632887b6-520d-46a1-8f23-2d37f1f9d184", "sighting--b944b9de-fa8c-4db1-8f41-51366bcb46bf", "sighting--f06e8154-371e-4685-8bb4-dec7bbb2b96b", "sighting--4f122307-5219-4fc0-958f-a56074287950", "sighting--0a55a140-b65e-44e5-9e1c-fdb559c51265", "sighting--694c9a14-d355-40d1-85e8-3b1fad7bd721", "sighting--f0dd2ccd-7f1a-4f1e-9374-2bd1a99f9297", "sighting--29006598-c0be-484e-a098-4fd1a0c69b41", "sighting--56328cbb-e485-4361-b7d5-7ec97945bbbf", "sighting--e1b1b4ae-454b-4264-a78e-3f2e85e9613a", "sighting--4aa23b87-bd7b-4227-9af7-be00d37b163e", "sighting--63662d34-9772-4708-9011-e3424572f4da", "sighting--f99c6202-5c7b-4045-b910-de1451d7e0fc", "sighting--c10e3f83-e41b-4c39-b526-a73d404f6816", "sighting--919eb624-df77-4778-8bd5-06eedbd5bb40", "sighting--fde4f1eb-b933-471c-813d-09aeb7582af8", "sighting--9c292134-826b-4d42-b7ed-278ae75b0789", "sighting--6284e5d7-d687-4a11-a5c3-179f1e11d8a8", "sighting--1e26cbc8-1db7-4373-8407-e57f2ee50f13", "sighting--649b349f-c73e-444a-9ea9-8be12ff251db", "sighting--1968f397-fbe6-4098-b353-50a996c1e6fa", "sighting--b7dc1f2e-2af5-4fab-93e8-1969d31af8f8", "sighting--3e82b3dd-1318-4d14-a6e7-fc6afdbccd29", "sighting--d449af5b-50d8-49c7-9a7e-1e60798342d5", "sighting--c63f300e-8ada-4cf1-8254-2bffa1685351", "sighting--326991e5-3385-4a83-9747-8de8de91c426", "sighting--951997b9-4757-49c0-98c5-3d380317290d", "sighting--9d1fef4e-ed85-4ba3-80ec-88ddda6ba450", "sighting--1f4ec523-f660-41e5-8ecb-8ee75e25e904", "sighting--3a5420c5-1c42-4c7d-ab94-8a1004305525", "sighting--6ca53990-9d93-4e43-8f87-09bf1c3fc3f4", "sighting--15a46a1f-57a3-4378-bac7-55264da91223", "sighting--5b8a56c3-4039-4c17-8caa-5c185881f9b1", "sighting--e6905abe-8ff8-4908-a8a1-a5a5a41af4eb", "sighting--2903e85a-4f30-4f34-a8e6-6d516bef6455", "sighting--fdecfbf2-1049-4c0b-80f6-cf319018fe03", "sighting--edd0fa57-9365-4cae-af29-b1d6eb8cbefe", "sighting--492265c5-0d23-459c-a0a1-01fddbd89b92", "sighting--720ef06e-27e5-4be1-9c7c-de9d2c493eb1", "sighting--00a2cbb1-2058-468f-a672-805b999935f2", "sighting--f44ddda4-a0d3-4f8b-be39-3cc91cec3c7d", "sighting--87fb7563-83cf-478d-b14d-87fc52709401", "sighting--de7e29bc-bd1d-4fcb-9f2c-e9ad34dfad86", "sighting--f1c63603-b91b-4fc7-9469-3ebff1dfe0c2", "sighting--5709b164-c4e2-4d7a-92cd-fd2dd893518d", "sighting--9901c745-4d4e-4555-8ab3-6364705412bd", "sighting--4e992655-3cc6-47a1-8352-ad840a8cfd36", "sighting--41c501c6-0ac4-4664-8956-c9e6d014cecc", "sighting--a13f3b6c-911d-4fc9-a38c-adef89ecbb4a", "sighting--ae735d52-66a0-4258-ae1c-c532a48a0885", "sighting--73ba5ad7-19fd-407d-93fe-daf65d07ee46", "sighting--deed7e8c-a05d-46a2-90ee-5b9e918e1538", "sighting--cbf65754-8e1d-49c1-826a-a3da84446ff7", "sighting--dfb82375-02cb-4bd9-9fa5-71cff9653fcf", "sighting--61a96742-8527-4789-b844-598b367ac022", "sighting--8a2d327a-8618-4c75-bf91-4e26da7273a5", "sighting--b7520972-547d-4774-8d64-49a33f053f6a", "sighting--54b8f357-4a2a-43ba-81a2-4ce7b79bb5f6", "sighting--9070c361-af25-4ae0-8c4d-5120c16a46d1", "sighting--23a3eb5a-8fd4-47f7-b47b-9ee82b19665b", "sighting--a043857f-ee34-4b14-800d-0fca80a52ebc", "sighting--8adb9e27-ff01-4d3c-a15c-05905efd17c4", "sighting--013b9566-a0eb-4985-868b-0c88dde92540", "sighting--4a1e2958-431e-4590-bb8d-4ce63e19706a", "sighting--1be997e9-0927-45ab-8bd1-6667a41996ca", "sighting--99e0037e-5b13-486e-a49a-db359be1e955", "sighting--048696de-b3f8-4486-b4ac-e1e6b456a716", "sighting--67bfbd5a-b76d-4998-84ba-2da24d47cf9b", "sighting--bb5a41be-1bc8-4b57-be01-26a55e369cd4", "sighting--f1c3536a-40f5-4e71-9c4c-dc7f83934562", "sighting--251a6830-9152-474c-993f-2548dfc208ef", "sighting--a6f6e556-8a53-49a7-bad3-43db9e91f66a", "sighting--a9efb604-966b-488c-bf09-2ef325ecbea9", "sighting--1d7ddd89-af2a-4d39-b2a8-a92984d4c291", "sighting--005d993f-8485-4166-8676-7539c2c8bf94", "sighting--df52b192-a1b1-4b0c-9428-afb9a2387074", "sighting--049def48-7c26-443f-a145-3c91b4e09944", "sighting--ae0535d4-8c0e-4b96-89c0-25134253eaae", "sighting--61af37c5-9028-4f46-ba6d-eb03867d14ba", "sighting--65fb4192-6dc3-47e8-bb65-6a053977d01b", "sighting--ce5f8fc3-2d54-4f8f-add0-07d9d5148ffe", "sighting--35fb23b3-bf73-481b-b607-4b518c1450f2", "sighting--e6b71e58-f29e-4d91-85d6-f9af4af4b53d", "sighting--01fd36e0-2ed4-42c6-8a6f-5a467a4f166e", "sighting--05123476-39d8-4b5f-92ba-eacd2fcc16ff", "sighting--3cf4dbde-612c-4ea3-99a6-5bc7f584fdc2", "sighting--9d5b69e4-36c4-4d0b-9049-c1ad78f1c7f8", "sighting--bcbc7997-fe99-463d-8b93-57a69be09dff", "sighting--43b4c3c8-d3e0-412d-9041-6347a7d29c91", "sighting--e0681660-73bf-48d6-93b6-abce5c778bea", "sighting--0bf7bc9d-60a2-4882-b322-c5958e0a83c1", "sighting--839ac1aa-0625-4677-80c2-6a2fc1b5a593", "sighting--571a482b-8861-4ff9-8140-6aaa02987d4e", "sighting--c731bcce-133d-4ada-a019-206a84abf4bf", "sighting--8186ffeb-261a-4969-82e3-ac867b002795", "sighting--907e21e2-4319-42a2-ab02-64226b2c4819", "sighting--5cc3760d-5322-486a-bed7-87f947a1ab1b", "sighting--e76e3f48-f2ee-485a-9b72-ecaedbace988", "sighting--14793173-684d-45af-808b-05ae3c1244d2", "sighting--8fa78de8-c2e9-4d22-9270-86e54c2b497e", "sighting--d5d0b53a-5ebe-4201-97fb-3a65a262c4d6", "sighting--b603a224-ac66-468c-b24d-2671a537d0f6", "sighting--d86aeaa0-52c1-4521-a2c0-7af61e3979a0", "sighting--824a11f4-c7f8-48cc-8ac8-20f4c4f80810", "sighting--0a53bd1c-439a-4790-ae91-a5714a637e0e", "sighting--fa2600bb-e355-43d0-b6cb-02d5c5642e93", "sighting--f19a06a9-7ca7-40a4-bf8a-2ce51a10f7db", "sighting--50f89458-917f-442a-81a9-901170a1a849", "sighting--c769a4e2-d56f-48de-b667-a08d13aa95c0", "sighting--3a6969f1-7f4e-45bf-a2b6-e8678a16fe98", "sighting--90c64b44-9954-406f-93d9-df2e0e5bbd17", "sighting--3a3c029b-ca34-4c77-b844-99e2cc15b9b1", "sighting--02c911d1-8b74-44df-af6c-2d2a9803bbc9", "sighting--a8ad64b8-e0fc-40c7-a39e-e8c52eccc8a6", "sighting--9707b68f-61c4-4cf0-9c21-3391918051e4", "sighting--f03cdf46-030b-47d3-a0dc-7ae2b4188f1e", "sighting--ae23bf34-5031-425f-a7ec-cbd22d23d35c", "sighting--bc820a31-a66f-4bc3-a0e8-53102d64afae", "sighting--d588ddd1-8ee5-4f4d-9a15-447aad258bcb", "sighting--9d1d5ee1-7ec1-4c6a-b4e5-dbfd1afa1af5", "sighting--6939513b-5f32-44ad-a29b-a322f1301735", "sighting--474c4932-c698-4c2a-9240-198f55830c83", "sighting--146abe80-6404-44ec-adb4-958f65c5078a", "sighting--26f958f3-e568-4a40-afad-e495b40a49d0", "sighting--373a3466-17e1-405e-b869-8f22358b69d8", "sighting--4cf31913-500d-49c7-9978-4d023ac6a7d8", "sighting--693d8fea-9c27-49d0-bbd5-acbd0fdecb39", "sighting--acd719b7-1e8d-420e-8c72-21b75b59c35b", "sighting--7291ad56-5f25-4f3c-a958-d4d0072f4db2", "sighting--da7fdd9e-5bce-4328-b962-c729fb52dda4", "sighting--17626136-a14e-477f-9644-2be9b08dd9bd", "sighting--1a09c19b-fcb5-4e21-98f3-0d6b64cb5caa", "sighting--1da6fab4-478a-45b7-b5c1-265fa76ba172", "sighting--d1d5d347-c8ea-4a7b-91ab-df2f5d8bca25", "sighting--6cfdc5c9-d0c4-4030-9221-64cfecf22e0d", "sighting--7fe5a74b-1d5e-4d7e-9041-924747276330", "sighting--0036ff23-7094-463a-8731-780eaaee622c", "sighting--f3e95f8e-2a33-48f3-97bd-16f2890e7154", "sighting--09fe3194-459f-43bc-89b4-33c6c5f39ee0", "sighting--0af5b16a-1c5a-4e74-9730-2af1f791fbbb", "sighting--dd7549ab-d076-4394-9c97-477b80766113", "sighting--36844bd7-e85b-46b4-9f1c-52dde7b8713e", "sighting--6e795dff-bd9f-4377-9500-2cad16940e74", "sighting--19e22782-04f6-4818-a461-e5090d0de5fe", "sighting--fbeba8f2-8257-4fa1-bad7-9ebad6916b42", "sighting--5b198ea6-916b-43d5-89d8-2cf3a874524f", "sighting--5847c1ee-f9e0-4f8d-9237-259a3645ff0a", "sighting--b4c67fdb-4d85-40bf-b89a-b68ae23d2d4d", "sighting--051a84cc-62da-4315-a64a-e5f6dda3d20a", "sighting--28cd3bcf-dcc9-409a-97b2-558e136b5203", "sighting--a98c6187-bcad-4586-a22a-d460f6d46c4e", "sighting--22406a34-3447-47e4-9390-029ca5480cac", "sighting--42de45e9-923e-4893-9466-9b9711dee32d", "sighting--07118aba-b0a8-4f9c-9151-3849239e7af5", "sighting--da4e84a8-0070-48aa-9d20-1e910cefa6ae", "sighting--9c2fd08d-abd7-40c9-a042-cf00aa94ef05", "sighting--77eb682f-ad78-414e-b6b1-fad006e78aa6", "sighting--220ee3c0-96f3-4d5e-9107-09249d5cb76b", "sighting--9f6efd77-c17f-4732-9cca-d4eee9b62c1b", "sighting--adc0943a-d0ad-461d-be43-e7e275d28433", "sighting--23c06c8c-ce49-4337-9ebe-d88ec87a72b3", "sighting--9702ce17-ea8e-4fac-aa95-f8240ac49889", "sighting--f6bf48a5-6fd8-4b34-ab62-64e23da0f526", "sighting--13325061-355b-417e-acad-659e9b3c10f4", "sighting--7e6d88b7-ab3c-4c86-ba06-ee54d7592c3a", "sighting--c95f8905-136c-4375-9a25-7300d801c35c", "sighting--da2ede35-df91-4ecc-90e4-a925299d4cf3", "sighting--c63e5ee0-f3a4-402e-8a9d-813df386d763", "sighting--4a6fefb4-17cd-4062-80b2-f3b3274dfe63", "sighting--0043b71d-ada1-4b43-ac83-3d62676f4169", "sighting--5d290bb6-5e6b-49e5-8bc1-7152761aa34f", "sighting--fef6fe16-95e8-42a7-ab86-98f376cf0d52", "sighting--17a0adbb-1999-496e-ac37-bcbf25f177d0", "sighting--672f0cb1-2973-4b90-abe2-13041f5a15f9", "sighting--acbc5eae-f03a-4c9d-a4c1-4e4169b24e8c", "sighting--c50a02f8-f333-4092-8383-a043355c1c56", "sighting--5595b2d0-2e2b-475c-89ab-3eab6ffe4005", "sighting--73a857e2-802c-479e-a604-531bc6b71cc1", "sighting--fe0da1f1-5859-4025-8368-958666cc4b5b", "sighting--9cdb351d-d31c-476d-aa43-3263cd0b12ea", "sighting--e832f2b7-71c8-4db0-be58-06242f4dea39", "sighting--25baa083-5574-4c52-ad9b-2a3424a99fde", "sighting--5485593d-65f1-46be-ba6b-8282f6d71a09", "sighting--e1b0fe4b-0f7d-4672-9f03-97f361d01b47", "sighting--d0a2e69c-f07f-4492-bf12-f6855b5b1f30", "sighting--cceed0e5-6996-43ef-96e6-02d94a7934fd", "sighting--296ed786-45ef-4da4-9705-66613d160476", "sighting--a82a9230-5581-48a3-89d2-196e9fe46126", "sighting--ee483055-170e-408a-ba9c-9c28f3ec2620", "sighting--8afa0123-54cd-48c0-8d3e-eb6f9d2fb9c5", "sighting--eba95c79-a4e9-49c5-8bba-9bad79ec3246", "sighting--7dee228b-4777-4372-88c7-ff449f0ac419", "sighting--1cd2d2ae-642d-47b0-b990-1869a5ee1063", "sighting--2decad98-fb94-4b4d-872a-8c31647a38f3", "sighting--416618a2-9b1c-4486-9129-7d8939adc225", "sighting--73de0905-1742-4d8e-8154-42f5a3468830", "sighting--3df9aedf-2a19-4cca-8b63-35b21870d524", "sighting--74dd2b05-b39c-4152-9a14-a391a556bafd", "sighting--4886760e-ef39-4d1a-bf9c-0c869a58ac68", "sighting--9b4f071d-7a56-45f2-8a10-41bc1c35f30a", "sighting--8e575063-0e42-4668-b83f-8e8e328660b5", "sighting--9b4f62cb-954e-4239-8f2c-c807649b7872", "sighting--9a5a23f1-ae66-44ac-b4bc-3c4ccf3e6ff1", "sighting--38e8cbc3-47ad-4247-8b4f-841b5b723b94", "sighting--b8b0b565-2058-492a-84af-44cbd6ecf42e", "sighting--9b4f0dee-e64d-4392-ba36-a596f50fd673", "sighting--d1f21b25-b17a-47d5-86e8-9f14820373bc", "sighting--de235fbc-4ee0-437a-97f2-0d2c7054ab61", "sighting--47d5ae1c-f2b8-4307-ba1f-ea42b0c138f4", "sighting--417e9477-09a4-4a4e-a6c1-f3fd54aa7e6a", "sighting--3f922d94-0ba2-454e-95ae-c74dc8340038", "sighting--70f3e8e6-a2d6-458a-ad27-9e520871280b", "sighting--cb9d314f-db80-4e15-99bf-029ab793f84f", "sighting--d628c4ac-1dd0-42bd-b005-2d589de0149e", "sighting--7cf11f16-292c-4d5b-b343-3deef5d1c81c", "sighting--5958bc31-5ea9-4140-863f-a906c966b11f", "sighting--bd1344f4-7154-4691-bb9c-e8d503dfbf2b", "sighting--1c196164-ecc5-46bd-8a07-e85ceb563d45", "sighting--f72c4832-d34d-4a88-a799-4222eaf69585", "sighting--532f5b54-ff1e-42e6-9b3a-21b751686741", "sighting--84162842-dcfe-4ad5-92d5-a60747295af8", "sighting--c0ba83a2-0ad2-40c6-8872-8a6766f10a0b", "sighting--fb677502-2f53-4a77-b790-e373b20ee029", "sighting--a9a14ed5-7da3-415e-a761-fb3c21d8f299", "sighting--8d3eb1e0-63bb-4634-807c-b27d867070bf", "sighting--ff295bdb-b2ce-4737-85bd-3f2a6c21e9c6", "sighting--4ad7ed3c-6cc6-425d-8d8b-2344b64338f8", "sighting--7e8e2bf4-f0ee-4411-968e-2d22e04e0a86", "sighting--7fe51801-e17f-406b-ad1b-ed523c70227b", "sighting--e2acecd8-7397-4845-84b8-94cf1f9391a6", "sighting--a024cbb9-2299-4520-b78c-b9557a095d54", "sighting--9bb5cde9-6331-456a-8105-139a311c802b", "sighting--8930ce95-e9cf-42c5-8c9b-c23d8ea9bb27", "sighting--3bc0e43f-a892-44bb-bc71-edd8dc362389", "sighting--4709046d-d03b-4269-a326-637b896fae6c", "sighting--dd3b613d-6179-4344-8d97-2d428879398d", "sighting--bea5c455-3874-41e0-89d0-f7c50c490e98", "sighting--20b2be26-48f9-451c-a06c-1b8247820c91", "sighting--8bf8cf1e-93d8-4b8a-985c-6229cd3ac278", "sighting--ab87f197-0ca7-4ac4-81ce-2c885a1b4877", "sighting--275502f5-6b72-418f-96ca-257012f0e715", "sighting--8c525f09-5025-4c50-9c39-37405e86ab8e", "sighting--f7fa803c-11cd-4595-b4e4-592ae1e6a9a7", "sighting--43c20941-bd25-47f6-933a-0e5f731aed38", "sighting--1bb987d2-eeb7-4832-9965-a09ea42f4da8", "sighting--99efaf7c-810b-42cb-88f2-813d8648a363", "sighting--d083d8fe-b468-47e1-953b-d5a6435bf6f4", "sighting--7c0f1dff-9903-4ba6-aff0-38e1cf2bb6dc", "sighting--52e19dac-b9b5-468d-9a6e-fb82e03aa4c9", "sighting--d2914503-f47c-445c-be60-36be39a5858c", "sighting--cf3f2f37-2bd1-4083-9e3c-34fcd5a739f2", "sighting--a20773b5-a3d4-4740-bd28-b56a8f5d0f32", "sighting--75a79b0b-5959-45b2-b9cd-e874a78a0258", "sighting--96be27fa-541e-4184-84cb-4e015ed08b6b", "sighting--d53fb750-605e-4b12-bd1c-be5378da7216", "sighting--ddbb85f1-ddff-4911-bbde-bc90b4601215", "sighting--b26e12e0-101c-4720-aa4a-873a0e40ac8c", "sighting--2ffcc279-4dd6-4c66-a717-91a5cdd842b3", "sighting--6093d193-0046-4fd7-bce7-939feae4fe2e", "sighting--77c48335-2f45-4f6f-91fd-1ff36cc9c547", "sighting--5ac35bef-e5e6-46f6-b797-f09e144eba72", "sighting--407d146e-93d1-470c-a0a7-4d3bef96947c", "sighting--7a0c60ac-181c-488d-a05f-f8a849b5ddf6", "sighting--6a0094a5-1b22-4da0-86f8-b015515ac31a", "sighting--82fb9124-9bf4-4a13-9af2-a5159013314e", "sighting--2e128dd6-8c02-4430-bb2c-a72371dbd890", "sighting--2a4ca808-1900-4f7d-b581-1d4f74f34897", "sighting--762d3db7-4fdf-4e52-98c3-504c07890715", "sighting--77f4d317-f3ce-4104-9068-f5b7c8028ae2", "sighting--805491b9-bea0-4fa1-b1ef-45c24d8b41f6", "sighting--549979d9-e483-4ebf-a4e6-b7357ed8454f", "sighting--c83f5ca9-b235-4455-bc97-34f6c2f54978", "sighting--af235027-79a5-491b-9d2f-73a5853426e8", "sighting--cb8131bd-2efd-4682-865b-019bde84cfba", "sighting--c72e7fe9-f974-4f4a-ac3a-4a94d03c7767", "sighting--4c45a5da-3b93-4181-8206-28098e01656a", "sighting--fb4e9b1b-b44f-4d91-92fd-94fcaf10576e", "sighting--9599271c-8f68-481a-9d77-b1508a1cd2de", "sighting--13b5c3cd-cd63-4a0d-ac89-e3d2bf10b8a9", "sighting--713e9e56-03e8-40ff-abb6-79c124d6917a", "sighting--04c58835-ba2e-450d-8102-b3c708cdec98", "sighting--98787c9c-6343-4e8d-aa16-f23d4db8db3d", "sighting--02edc3cb-c8c7-44ad-aee7-94a22662fb2b", "sighting--ba759a8f-bdaf-4e51-b387-106e3e1c0fea", "sighting--9acbd575-95ab-46d3-9ee8-fc58b7a42101", "sighting--88f44c20-d038-4457-8ee6-5c1a6a4dfc48", "sighting--1bf8298e-a4af-49d4-84bd-238297615635", "sighting--36034a07-bf79-42ff-ab28-9a5d1169dfa9", "sighting--7746f568-a914-4aa0-8860-232f88356d3d", "sighting--df9083d5-9355-4249-909a-fe1af0adf5a8", "sighting--4e43e8b2-5fb8-4814-8bc8-100cc429fbb6", "sighting--eca65995-dd65-456d-832a-2a1f4d8997d3", "sighting--8832a244-cb8e-4277-9389-8abf7c7e02b8", "sighting--5fc0466c-ae1d-4ca3-abbe-0459bf7b520e", "sighting--a3e84ea3-a035-432e-b990-bf2f4eecc8e5", "sighting--6462f6b7-9b37-41de-bbe4-8c44284e35ec", "sighting--4202fe36-6b89-408f-83d6-812235a7cded", "sighting--f2033241-7738-4c09-8137-6c5e7e5a811c", "sighting--aa62d701-a033-408b-8f61-961c432f8ecc", "sighting--d457396c-3eda-41bc-b6b4-ddcbcb92d09b", "sighting--4e996612-986f-4939-b7e5-92ec85a59ff7", "sighting--ead90176-a5c9-4deb-80ac-ffdc1b730639", "sighting--f582c8d0-12ec-48e3-9582-3978bdb05099", "sighting--1b8e168a-2319-483c-8f70-46fb1f1ea8c5", "sighting--d9db0837-30a8-467f-8bc3-2637eb757b00", "sighting--d25bf8ab-fde6-4c3f-aef6-e806aabb310c", "sighting--a4fd73b4-f581-458b-bcec-0dd360b9470e", "sighting--1a8010aa-b60f-4e74-a333-737521b7cd90", "sighting--22e2de11-c198-47c5-83a8-bd02ae3ce005", "sighting--aadc0b1d-c966-4602-9276-db5f22de1790", "sighting--1e0cc96a-b967-4a32-ae5b-5f00d54bc85a", "sighting--4b7dba31-b3f0-408d-b740-34007868003e", "sighting--b78c45a6-8876-4e3e-b93a-19cbab268a08", "sighting--39148e2c-51b1-4ded-b5e1-f559e28922c3", "sighting--492a766d-1cfc-4aff-9e94-bdd6c08e0d77", "sighting--d5cd56d6-001f-4a67-83b6-35a9f49064ed", "sighting--26d50110-a889-4285-95f8-24c243ece2ee", "sighting--0995a451-aca9-4b65-8bc5-43286e95c26d", "sighting--27d019eb-52ad-41b6-ab04-58a0350e9dcc", "sighting--2a4fd4c4-7b2c-4ffa-97b3-1906b418f393", "sighting--2b6ca106-c96c-4e7a-afa7-82543d992bbb", "sighting--1b8b135d-d858-42c6-bb77-0d6613bac55c", "sighting--38597070-54b7-4ed4-9813-f7b53bcb0dac", "sighting--745ed1a6-64fe-4557-b863-393aab0cc324", "sighting--8ee88433-ca2f-4599-ac64-b83c384572ba", "sighting--b99150c5-cb18-4434-bc5b-9abd53de4272", "sighting--e46e7b7e-bfae-405d-8e3f-15c0ea8b1cc7", "sighting--38e87f3c-f603-480f-bc09-ef9278a26d33", "sighting--ae3c7f21-0e8c-42f4-ba93-5406c266eb2d", "sighting--1bc12d00-ab4c-435b-af72-5d37a14d3bad", "sighting--a145644b-85c8-4cd4-bd10-1acf4b495ff2", "sighting--c79ad274-6a6f-4ede-81f4-7371f44e07ae", "sighting--dd87915f-a9d9-4e15-91ac-0e4e315c6969", "sighting--c87648e3-d695-436b-a3ee-958e562a9c68", "sighting--aad67b60-4082-455f-a06e-7ec41727d4c2", "sighting--b8e99678-2d02-4978-89b3-a3b29fe45aab", "sighting--47029623-cf5e-40ee-a961-cb02ac2f10cc", "sighting--9a9eedae-c63d-438d-bd2d-0df8bb260d49", "sighting--0859236a-3c2c-4e11-99ad-5eca10e12e34", "sighting--c78ad937-e427-4eb8-a37c-29abafd5986d", "sighting--dee99a29-f5bb-4a94-a41f-7e41ead17eb9", "sighting--89509613-16c1-4636-a04d-348615cac970", "sighting--4da222c4-642f-4545-9c28-ed686de10b30", "sighting--f2864844-c889-42c0-9687-c1c9679b24d1", "sighting--6ecb3102-2821-4e12-9524-37e7b9aaee99", "sighting--da3719d4-1f00-4d3f-82b2-dc71831c74e6", "sighting--0c6f83ce-2986-465e-b143-7eb2d7e96900", "sighting--ea701de1-de8a-4f9f-92bb-c65a7187b897", "sighting--911e06a7-8c20-47fc-8032-a2799c0a7fe7", "sighting--2c713a4a-2f9d-49a4-8b7f-9c996e3130e5", "sighting--31e0c86b-ee74-46ec-888b-378422f2db9d", "sighting--c2cea239-ab6a-4f57-986d-3f1c5961035c", "sighting--83fcb783-d758-49cb-a26d-ed7283b6392c", "sighting--80a1caa2-f578-450f-ac56-fb9e98425887", "sighting--82f1120e-a5f1-481c-bba5-8b17c025532e", "sighting--07b46e21-b3a0-428b-85fe-5fc3dfc95306", "sighting--352e4255-a20a-42df-b5a6-0eaf623323b6", "sighting--dbc29621-f674-499d-9d61-20a0f1a6abf3", "sighting--3371d682-9d63-434f-b87a-c2fc99ddc378", "sighting--4af5626d-8ca0-44da-95ed-487c9f582db5", "sighting--9093377a-9552-4ae1-826d-a8a45fdc3701", "sighting--11085a6e-c9fc-49ff-9a4f-f2d522885511", "sighting--a46b2224-866c-4233-8c39-dbc294f85b4a", "sighting--d131b6aa-856b-4d78-82d1-96bf92e6da33", "sighting--c0cc8c85-cd4f-474a-849e-119ffbdb0de7", "sighting--0502a612-c24b-441d-9de0-0a62fa394c19", "sighting--a48039a3-6539-4009-bf70-9c2987e594f7", "sighting--1cf67742-074b-48b7-952d-8cf5fafbb17d", "sighting--13d38462-eed3-4f09-a800-8a876ae93b35", "sighting--2bfb14fa-200b-48dc-8d6b-ed37d5855805", "sighting--f73d0a40-7cd4-4678-b0a5-0949889bbba6", "sighting--a81acb27-e18f-496b-8a4a-76b65d452220", "sighting--cf40777f-d7b7-44b0-ba3a-32b7d5119d22", "sighting--a4ee04bd-4b92-44d6-8929-8619791f6c95", "sighting--2ccd48e4-4701-4f73-b81b-9f15ec9d818b", "sighting--ab3b4c2f-aa24-470c-8e51-bde63230867d", "sighting--2bbf5d1f-ba5a-4c69-ba01-08b62e39565b", "sighting--7766ddac-c965-4974-abe4-55085f774412", "sighting--2fed0900-ff98-4d02-9b37-5ac8cffca5c3", "sighting--0e5e5dda-6e1d-4d39-8d66-26fe59e88f31", "sighting--afc63f88-b00c-4476-a8da-a956cc3a90a2", "sighting--c53a98ee-3ebe-449d-948a-0b9e7b0e1da8", "sighting--784d0d82-8ff6-4e02-9c3f-4300f90578f8", "sighting--7513f132-5eb7-4182-bd80-99e9c26d6c46", "sighting--d1667fad-15a0-4fce-874d-c1754c94791c", "sighting--f4045946-4470-4589-b234-defcc757498d", "sighting--9236ea8c-1dc0-427a-a5da-d8b3b0950fae", "sighting--b8e3fb9f-0755-4357-bbad-41c4757dcfe1", "sighting--0064bba9-686d-4d24-ae75-c424626aeda0", "sighting--68478ac5-1749-4f21-b2a8-f232d5349b10", "sighting--173ec97e-d636-4f69-9960-5aec187754e5", "sighting--9e8701d4-004c-409b-913c-e8009cfcc9bb", "sighting--640c8d3b-a453-480d-985b-9485c8c7709e", "sighting--1308c529-6af4-43bc-977c-47a21b9cffa0", "sighting--16bc2150-9481-4886-89a6-1dddf21609e1", "sighting--a0a4b1dc-c404-4a4c-b652-fefb593ff22d", "sighting--809ecc22-f258-432a-ad9a-615245433dc8", "sighting--1ecb5955-f399-4c51-8884-73fa709ac6de", "sighting--73530cd1-b40f-4323-adc6-b69cb118a12d", "sighting--ff8c6f9f-6fa0-4bdf-b3db-38c0fe8e79ec", "sighting--2a6a63d5-4fe6-470f-8e8b-53b8325fa14c", "sighting--5bad0896-52fd-40da-a6f0-c3854ca78847", "sighting--72567d12-7ced-4418-bb29-a4327e4da682", "sighting--4853a003-fdb5-4637-ae2d-61d26f4517bc", "sighting--d79d3d31-8f90-47df-b4e5-06e676476149", "sighting--5390c771-b89d-4772-bb75-22b82b491f33", "sighting--fdde3052-6002-4590-a354-36e3f2571637", "sighting--fbc89915-edcf-4594-988f-e1453b4a364b", "sighting--5ab5e78c-e753-4ade-82bd-3d4fbac1d90f", "sighting--8328939b-f85f-4efc-aac2-cf20a0a5423c", "sighting--e82b34e5-d998-48ff-b4b7-ff36f42e228a", "sighting--e008dd2c-e85e-4a9c-b85f-f64d10062111", "sighting--ce02985d-272d-450f-bbf1-67516953e3a0", "sighting--9f4d9600-1471-4236-afd6-5450946a2924", "sighting--6448a1e2-5dc1-4e30-8470-e81ae5248ec7", "sighting--b7b48954-e043-4bee-8dc3-0195b7dff819", "sighting--29c3363c-c32a-446e-bc96-a15aa83829b7", "sighting--1d16026b-a46d-4b09-807e-5631baeb3596", "sighting--365d1583-0463-4ad2-aad8-15d62482d04f", "sighting--9c5c926f-7b99-43a0-82b2-be8f971f90f5", "sighting--8d7934f5-3d00-4b7f-af18-aff4f405a4b9", "sighting--a14ef669-6f45-4414-a0ae-c481a4e903ed", "sighting--ee84d110-c657-4792-9254-47fafab50ebc", "sighting--62fd29d6-78a0-4d28-ac2f-57a46402441a", "sighting--84d9aa7c-666f-49ed-8e9d-ae0abce904dd", "sighting--80754711-c4c7-45af-b4aa-a0164b2996d2", "sighting--3289d9f8-3c22-43df-9959-1600f80f3221", "sighting--416de464-3dfe-4d82-a728-9eaec3ac435e", "sighting--04a60f61-e102-4f31-a15f-7bc67043e52a", "sighting--e77f8491-bfa1-41f1-a883-8750df0692dd", "sighting--8076c4d8-214a-441b-96f8-3ffd41a59e94", "sighting--8a5f7ebe-1472-4df3-87d0-1ccbdfe5d958", "sighting--aa1d9149-b431-42ea-8b17-58aa6b599854", "sighting--46e8617c-0dd7-44d3-855c-3667212e9025", "sighting--99c7751e-bd95-4175-a7e9-37afd7e6fe7f", "sighting--11d94b02-3467-4d3d-bc65-e908a0cbf246", "sighting--355c9fff-bcd5-414f-87a2-fd40429a8b26", "sighting--f5f17961-d9e2-4a32-bb22-fa85d04b8974", "sighting--bbf82275-142b-4167-b0a0-4360046d5f8e", "sighting--fdadd1eb-22fc-407f-80f1-ed1d4585f206", "sighting--f8a59ddd-200f-4bd1-a490-dd0c72318f1c", "sighting--d2600ace-2923-42b2-898d-aefbfb8e12f1", "sighting--98b4aed6-b9e6-4144-b5c2-1236958455e4", "sighting--25ea2e18-267f-4024-9d38-c961d8b5821c", "sighting--15f2734d-7bf6-4595-96c3-0a0098481d2d", "sighting--37d4c7a3-5b85-422e-92d0-a256a3e9d97f", "sighting--b0e2e2b3-8a44-4cb3-a776-e608ba21da96", "sighting--74e32c2c-1840-494d-aa9c-89efcc5d97b6", "sighting--f940d85e-9cfb-4281-84a8-a9c6b490da01", "sighting--40c69a83-4a0e-439c-8759-6953a758f731", "sighting--e12cc44e-1fdb-487a-a7c6-1ad0126584dc", "sighting--6dab3137-5dab-48e5-88e3-049e958f6433", "sighting--04badd39-8e7c-4436-8035-02a41384ad5d", "sighting--56445522-791f-49ef-8ea6-a33566d05a7a", "sighting--fdf7a836-e342-49fc-b0c9-4b35f8d47cb2", "sighting--352dd6ac-075f-423f-acbc-276dd9e02468", "sighting--f573caf7-e08b-42db-bec3-cfa163ed0308", "sighting--29c1a832-000d-49e4-8fb2-c3e472820fd9", "sighting--5d22926b-1beb-4ce0-863a-3f3e22dfb24d", "sighting--037450de-cdea-4b7f-9010-fa400e53a923", "sighting--cede034b-3fd5-4eb0-82c1-d17fb3b3d5e6", "sighting--a960957e-7fad-493f-b38f-acd728ad4882", "sighting--fe6b46c8-4b15-4341-844e-af36db4ea0ec", "sighting--3064001b-f5a3-4705-86d6-c8902f981055", "sighting--add5c91f-7ca6-41ee-a642-9a4e743cfb68", "sighting--57b57bf6-2ce7-400d-8594-0b1abb756720", "sighting--e28d033f-a87a-4b77-bf4f-fd1749d80986", "sighting--861f3d16-9072-4330-ae51-18da2c0a0869", "sighting--04d1ae86-1956-4098-9e49-bd77282d7cd8", "sighting--9dd1bc5b-6448-42ae-800a-c58f8edee20f", "sighting--18d3430f-b508-4504-9bd8-ffc88bb46c83", "sighting--18afae9e-aa47-42aa-a700-056cabb07aa1", "sighting--c6043ebf-2d9a-442a-81c3-04ecb189a97d", "sighting--b7d64d25-2c4b-4bc7-b947-38ecdaa74393", "sighting--6d3e3b49-cadb-4162-b4df-3c53fa0de9d9", "sighting--6a11c405-f9ce-42e5-b028-8437e844cf81", "sighting--ea12a47d-e517-4fae-a60d-545e5157f995", "sighting--16bfaf0e-9823-4f57-b25b-9ffeccb4031e", "sighting--538f1909-bf46-4bad-95fc-192f56267412", "sighting--0e58fceb-48ac-45ee-9377-d668730b66a5", "sighting--992d36f8-65fd-4da9-b011-cacedc9ec620", "sighting--ef2f5bce-05f5-4bb8-9ed8-d8e3ad29ddd0", "sighting--d29690fe-9b16-4ac1-b8e6-a7b21d04f70a", "sighting--7464463f-f0e2-4b55-9a37-a4516ad030f9", "sighting--bc756a9e-c9e3-4420-ad37-3bf907758ad9", "sighting--d46996d6-663b-42a1-a51e-2caeacdbe401", "sighting--1ad7dae6-259b-415c-8a99-2ee9c0817b4d", "sighting--395c187a-0309-4547-b89b-a715f4aebb5e", "sighting--4b783d8f-3728-443c-a553-440e37e692b6", "sighting--021f1d4e-eec2-4734-a775-5110eb12a834", "sighting--a5a347bc-15e1-4f65-87bb-0f2e37853e8b", "sighting--a3c452d6-0fe2-40c4-8460-013f5e2f5e15", "sighting--02708aa6-8a46-4e4b-8e28-711436a14471", "sighting--86072fc7-a69b-4c85-a725-759e0487ab89", "sighting--26cc943c-b4f9-4217-b5f9-9db5bd3ecac3", "sighting--73df0820-92ff-47fe-95f8-57937538b9de", "sighting--d6ef9837-5b8a-492b-b302-350a9494b642", "sighting--92570422-ad06-4ff8-a78b-6b50d54ea401", "sighting--c61b4a5e-5401-4576-9418-aae029b146e2", "sighting--b3677613-e69c-42eb-a23f-410f221aed57", "sighting--8e9d7366-4635-4588-83e7-c4f361ee6fdf", "sighting--c252a46b-7d31-4481-b800-c6d8bd61660f", "sighting--900fcefe-dd43-4c1c-a227-4b3a0a849f3a", "sighting--ed2fd0eb-ddb9-459d-ad6f-7b836b537207", "sighting--48907628-121b-43ed-a17f-c5ceba9bf14f", "sighting--57e6606d-4e53-41d8-9bd7-c4850476366a", "sighting--3309fe17-e439-4e8a-ba25-0b5281ab70a2", "sighting--ae17c03d-71b2-4c61-afa5-80a89cb3d1b8", "sighting--bff2b283-acfe-4776-a071-72c9720f2a9f", "sighting--2d7c22cf-cf4f-469e-97d4-5ef5f0ebfb5b", "sighting--63fe37a9-659d-4b14-ae0e-46de0266add8", "sighting--99d10329-e27a-4737-8391-942c2b6e1061", "sighting--278005b3-c907-4326-b592-edadc48bdb61", "sighting--1dbd094e-b1c0-4bcb-8bfc-dfcd9eeea54a", "sighting--c7ff721e-a7b3-4c3e-8431-be5c31f46b97", "sighting--fb2063e9-0a6d-43f5-a812-e3b1d083f7f6", "sighting--6d30a90b-77ef-4412-b206-36095b5ad7d7", "sighting--4df0f66a-9e76-4da4-ac15-f151002eeacc", "sighting--0102a997-3ce3-46c5-a754-68387338451b", "sighting--b030b6a0-b80f-465b-a5cf-e44de7c9be92", "sighting--f90cba96-4448-43ee-a472-1611b6af6a63", "sighting--84aa02c2-651f-4aa4-aa43-279635c8fdf0", "sighting--f8989f3d-5a82-4cb4-817a-068bd062f9bb", "sighting--50cf2b00-4e5d-404a-9be9-cc1edbb25b8f", "sighting--9fc3d555-7291-478f-91c7-25149c5e34b4", "sighting--eca8c820-773d-4443-8fad-d04bd6640ee6", "sighting--0795b122-059a-43b1-93dc-54cbae4e83c9", "sighting--1af24d4e-b61c-47f4-86d0-f234e5edb316", "sighting--2f8fbdb9-b418-4400-b362-437318580dbb", "sighting--7c280d62-d312-4f97-ae98-675108e6fb4f", "sighting--4e9be951-5424-4dd4-99d3-51e8aed2da48", "sighting--ccfd8ef8-ec60-4e1c-bd63-b8df57694ef8", "sighting--0855671b-a637-4895-a417-1d26f10f0fed", "sighting--086cc46e-7ed7-49f0-b632-7cfbb5611a41", "sighting--3e68bc38-b0f6-42e5-b720-cf4948a9f62e", "sighting--184d0f29-7c8c-4115-a105-75cb29298fed", "sighting--fa10e8b5-f50e-413c-b55f-5d21f36857ce", "sighting--9d2cfcb7-a058-497c-9fa9-f0b7d79d9fc3", "sighting--9fc42caa-ad33-47e2-a671-e7986849b0dc", "sighting--53536a8c-5522-4e2b-a1ff-74472e98aa96", "sighting--7c022277-926b-47e3-86e9-ddd123e12274", "sighting--2d655134-2c77-4f04-8758-c15eb24b5b71", "sighting--f89e1549-349f-45d8-856e-187c40045d19", "sighting--66a5b137-d5e1-4ff6-a537-ed1a2eada498", "sighting--49778cff-19b0-43db-9009-00f78e9ae097", "sighting--0cfd90ce-0022-4b41-9645-0d232156ad19", "sighting--d6a0ebe0-96ac-4f98-951b-7b06545c9052", "sighting--aefcb380-a3d0-4814-a19e-7b2f4c2e40ea", "sighting--307d4b66-bbb8-46a1-8672-6a52bea1bbc7", "sighting--db88d001-b773-4d84-a4fb-de1b315d8f9e", "sighting--4078e974-e7fb-48a9-8354-4d1238689b98", "sighting--767bebac-4835-4d5c-8e6a-652f385813cd", "sighting--6570412e-7bf2-4a86-b840-4412dda09407", "sighting--657c0622-362e-4892-870e-4535c55880c8", "sighting--66736dd9-919f-456a-8e11-74e2ee924161", "sighting--01504d0b-1399-486c-97c8-68778920cbba", "sighting--fc191b08-214a-4bea-b0db-e08478fbc449", "sighting--1bd56207-2a82-4882-8346-bc231db53ada", "sighting--7f78b2cc-21e7-4bd3-b02b-6663101d9df5", "sighting--34796400-c807-4249-baf5-f1e1859ba079", "sighting--d5b94d4a-df9a-4798-965a-b8bf3f98827f", "sighting--43a65d0e-74dc-4e3c-8274-575831098be5", "sighting--3d869fda-d257-4e20-ad43-c5c0bbba3100", "sighting--16e15553-2903-4b53-80f0-7d3d16ecf22a", "sighting--410e32d2-a998-42de-8dcc-b02410088aaf", "sighting--cb24d2f5-0aac-4b6a-8bb7-e3b8e271e731", "sighting--30c9eb38-6001-4c2c-a5ca-ed98acd3bec3", "sighting--7bbcbbbe-130d-424e-b984-82a514b894ad", "sighting--40a6805a-0bdf-4ce5-9313-8677e4d3eba1", "sighting--e3eb7f84-147b-4a47-b44c-04e4cd1b6f0d", "sighting--a4762581-6284-47bd-8ae2-e25dacb30edd", "sighting--82b89848-aeb5-4925-baf4-3e63d0217885", "sighting--0970b832-cbe1-4991-b30c-cb000fde249d", "sighting--f0f32106-cdd3-45c3-b0b9-0bf63f1f7be3", "sighting--b9c5e313-aac4-4604-98c6-22a250fd7f01", "sighting--d780cdca-6452-47cf-858c-0c3ba9a40494", "sighting--e19377b6-5f82-4a0b-91f7-f950a19930b9", "sighting--0567573f-ce2c-456e-89ae-e679236f8db6", "sighting--65b17be1-2f5f-4966-a422-9bc14f2924e1", "sighting--ec94ecca-c6b8-40f4-9e43-1626253da466", "sighting--77ff3668-e8a4-4278-b458-c380ea9238ff", "sighting--51292d2a-8eef-479b-863b-9e7f721452dc", "sighting--21f14212-2c25-49c3-becd-ee2e0fba9119", "sighting--7cdbfd55-4b39-437a-ab0f-566d42550340", "sighting--9eeaef56-b8f4-409e-802c-63d9baa63785", "sighting--e6b4aad3-fa11-4ff2-8a4b-5f87bd40de7a", "sighting--4acf515b-f32c-425f-aaf5-046a69ef6435", "sighting--3357bc26-a261-4c88-9353-4cd3033499d1", "sighting--4bc28897-de66-4e0c-85f6-5d5bba4c9df0", "sighting--bafd3245-cdaa-41e9-88d6-154cc3fe4eed", "sighting--45084b31-d4b1-4b31-a935-963e249bc98f", "sighting--28e13902-129b-4cc3-98f7-a90da09faba3", "sighting--859c68e3-d0d4-4056-8f3f-8e3aa532100e", "sighting--3b5500b6-9f9e-4768-a313-75ac847529d0", "sighting--ffc3b3c3-823e-4359-a4b7-b8249f5d5485", "sighting--ef224a69-33e5-4c49-9698-a5344da43b52", "sighting--2d18f813-b030-4fd1-a61f-4b40a4f3090a", "sighting--3e587a73-7bd2-4f7f-a846-8ad574fab7ff", "sighting--62444938-ddff-4d24-bbce-20ab391d36b1", "sighting--d3bcc7f4-953b-46b8-8f12-f341fadc8b18", "sighting--34b45e68-91de-4b71-9094-17b939b590c8", "sighting--641ab751-d97a-4b4d-a6b0-c834d932c020", "sighting--e3e79c40-4e5d-4e9b-a104-2003b604b440", "sighting--268da865-764b-4291-8d11-f42f6fcbfe6d", "sighting--bbb11d39-b812-48c9-90a7-9dd3338a940e", "sighting--54816cdd-ca12-4680-b86e-302f2190992c", "sighting--affb9e46-c7da-40bd-9dcf-404a62357212", "sighting--670b8f6c-6428-4bf4-b3a8-df21eafeb3c2", "sighting--dafca2a5-7ce7-47fb-ad91-f5a327c9e635", "sighting--a09ed067-6c1c-4433-a2d4-276eb3321ae4", "sighting--46fc879c-734c-4e4b-95d6-5d0a380d0d71", "sighting--96ec51bb-efe2-4c12-a66a-81be0e99b5ff", "sighting--e369c053-ec40-408e-9447-b3e200b2983d", "sighting--71d39af3-bf12-48d4-bd7e-a512e79a0061", "sighting--46685607-37e0-450e-b6a7-a868092cea47", "sighting--7ced9f05-c0ac-4117-86df-f1c2da61a432", "sighting--4649eb47-8fc2-47ae-980a-15cc082d6313", "sighting--ac912151-35a8-4672-b070-5fa73fd4e823", "sighting--94a7566a-552e-4397-bb4b-9f9a7f8f9825", "sighting--ef97f087-cbae-49bb-b46e-4c8a826fb514", "sighting--c3ae7596-cc1d-4e02-b2c7-1562f6361a62", "sighting--4b30c401-e907-4065-bcfa-3e02ad826b3c", "sighting--b31e9dba-0ed6-441e-b480-987ed234c3aa", "sighting--877ed3aa-eee1-4702-be4f-c0cb45720078", "sighting--528fe26a-8a2c-4cd6-a81e-883f6c1bed41", "sighting--2bc4f050-6060-4f79-bebe-f61bd4d191fb", "sighting--9e96b0ab-bb1e-4960-a4ef-5156ae84a7d8", "sighting--e2ea2ca5-fa59-4094-b5e3-8c066f06784d", "sighting--8f412e60-8b15-4051-8357-02caec916c0a", "sighting--d3e081a1-2066-4431-83ec-9994c4972b3f", "sighting--e42a9182-efbf-4670-8fb1-535052e2b527", "sighting--db00ba0a-92c8-4387-9ecd-d6dfb12a00da", "sighting--f61ebbcf-7088-43b9-8f91-c5d00e9ef232", "sighting--d83bc749-3790-40a8-aa82-a79d235a9b74", "sighting--5e4b9ce7-4bf0-4927-971b-3243b3a9caaa", "sighting--99edeed5-8ed3-4617-bd12-968ccf2ac35c", "sighting--7738ef8f-a57b-4197-afcc-cbb73a21b342", "sighting--555a118b-0648-4389-87d7-5b2a3d7b1a36", "sighting--cfa0f547-ded0-43b1-a5e0-6fda516ccee3", "sighting--039a5ff3-527e-4f80-803c-6387f81bd809", "sighting--d348778b-95f7-4c32-a8b2-0e04354f17cd", "sighting--33c7f187-b961-4ad4-89f3-5c7caa0fe250", "sighting--5af5cdfd-aa59-40c6-8457-816d251bfc82", "sighting--86447833-3abb-45fb-89b6-94e9ba1c75bf", "sighting--72564024-9be3-4b19-8386-931355f878f2", "sighting--56107e29-5326-452d-a64e-c8c16e810556", "sighting--025db390-4923-4007-aed6-8042baf18312", "sighting--001945ab-721f-4ce8-a3c2-f1ae327c6c34", "sighting--b3998475-f4a5-4260-8bc4-e864480ef3ac", "sighting--737485ee-318d-4deb-b998-51155bb5cc01", "sighting--c09f974b-e959-48ce-83a2-adfffa0bfea8", "sighting--e1911512-f431-4605-9f0b-9c82faa6296b", "sighting--e3cbc25c-f951-4f46-8495-898a96410883", "sighting--0d39c311-e46d-4612-896a-0f1f86fa3f35", "sighting--b34fa63e-d4dc-45e4-99ae-be689e91af0a", "sighting--ef99c7bc-b7d3-42c2-95c8-aba0e7017db9", "sighting--f5e48326-2613-473f-a522-0732ac269850", "sighting--e26ec89f-bb53-4c69-b3d7-2ee7cf9f1bab", "sighting--c0820674-1188-4350-8929-73bad1379ffa", "sighting--eda09ce1-1b51-4292-ba1c-1ce9176915e4", "sighting--f7ab97de-7b35-4c35-9e3d-012b7d5b77e9", "sighting--c9ae3d0b-168f-4643-8a8f-c82f1a411593", "sighting--1467c4f1-4163-46d9-9cf6-b570afe7fce6", "sighting--e908a765-3a1b-47d0-a993-af0a0af51d13", "sighting--8dbc5b7d-739f-4564-9511-04f42e2c7d1c", "sighting--053493e7-905d-4c75-8a18-9514690a00c9", "sighting--907356e2-fd6a-4a77-ad96-ae22ec5adea0", "sighting--be3e4efc-64b9-4444-b641-a1f3a6a03a0a", "sighting--9b5d60f7-8612-4771-a481-34e6ae5e297c", "sighting--9eca6ce2-0c43-4a06-b0ed-ef35bb27233a", "sighting--9f699510-34ba-4fee-a1ab-2cae6fc68d3a", "sighting--73b16879-16c0-46c1-804b-656b0b4c83bf", "sighting--aa02b9a9-6212-42c9-9c08-45455b0f3d6a", "sighting--28433bae-d9fe-4874-b1d7-1d51f2f20ff6", "sighting--fd729837-2d11-42a7-ae8d-e5395ecaeb6e", "sighting--2d7742a0-bdd2-4b63-9e1f-e25917546829", "sighting--9f63975b-3ec1-42d4-9e19-73bfaba1c5f3", "sighting--311ab05d-0120-4d99-8da8-ddb7fb6d436e", "sighting--064ba5c9-1bb4-4f62-a2d9-a6cd59d14e90", "sighting--444bde03-09fb-483c-acff-85bccf0e6765", "sighting--a66366d4-0e5a-4288-857d-8ac670184fdd", "sighting--5aa1d6f3-dcef-4466-a956-1b1d62a1783e", "sighting--3ea62bec-7f79-427f-b5a3-bdf1efbf9457", "sighting--9749fd16-0dac-4c8e-9451-3d0b8541d678", "sighting--c47e3e09-8357-4902-873a-6d2c6d17d325", "sighting--7f0c123c-05da-43d9-b368-29c954c6bf9c", "sighting--6c3a75ac-44dc-4a49-a04d-9279a7a761fe", "sighting--d6c44c7b-e17b-404b-8f2f-3282d57788c4", "sighting--c4531e82-1c03-4d50-b988-d24975391fbe", "sighting--91ad5e88-b7df-4a08-b504-408161cf3c03", "sighting--813f84b1-4344-4592-bca4-9d483f320f23", "sighting--0412b87d-1e80-482e-bf30-21b6625ac6c3", "sighting--fe59fcc5-fac1-4e6c-bd8e-f71d3c86e412", "sighting--5125eca0-4e1c-43f4-b66c-cc72102d2dfb", "sighting--781ce000-1582-4908-b558-59450ef11d0a", "sighting--7c56a51d-1ab8-4590-aa1f-401bdca1cdb5", "sighting--fe88d8a8-f1ab-4500-92dc-1e7a0f4237af", "sighting--25f5700f-f1c6-4963-8873-f5305e5d5ed0", "sighting--7c57d8aa-d59a-4973-b858-7583e7d2d22e", "sighting--ccd07dd0-4e9f-4e45-926a-355413ae5e32", "sighting--9112b8dd-689e-4d13-b643-c30fa4558ce2", "sighting--27fdea44-e538-47de-9c27-f9423614fa31", "sighting--c4e814bb-3661-4efc-97d3-d2bbf711893a", "sighting--66a7056d-4601-4e67-8ba7-f56ac5283e82", "sighting--f66849b2-bd8f-4d3d-b857-cf6c320a5a3d", "sighting--0682e16f-968f-4599-ba85-88b2cff5b972", "sighting--665eb2e9-d182-487c-911e-d2c31a58cc17", "sighting--b89a8de6-59b2-4cbb-a325-6d99f3084486", "sighting--811ab7d8-708b-4a43-ab66-87023b131862", "sighting--2eff5fdd-8ba8-44f0-813b-2f8dc7945b1c", "sighting--3e33ea43-2781-41b7-869d-f8e4f00b1d94", "sighting--de531a5e-f7bd-4429-b96d-6890e498bfa2", "sighting--3c31f142-25d2-46c4-83ea-b86993a560dd", "sighting--1268f555-c739-49b4-8d7f-7cb3a309f369", "sighting--bd88d241-4c8a-4916-8294-0b577e986d30", "sighting--a8439dce-ac2c-4567-88fe-764f8f98d025", "sighting--23113618-cab0-455f-ac80-234fe96bd21f", "sighting--177baea2-29bb-4fee-948f-c766dcfac321", "sighting--011a24ca-32ed-4daf-a3a5-84783ac1ade6", "sighting--2a9f3f5f-0ae4-4402-a3ba-17381ee565d4", "sighting--b0637a47-4eda-4754-944a-914e4f334d23", "sighting--51f9f778-15b2-4418-a977-34b662857a2c", "sighting--1a0ae6c0-6bd6-4a80-9a35-c06b0e2d2460", "sighting--c9c5a9fa-1ff0-4ac0-a3d6-aefea3569755", "sighting--4b409de0-f32c-46cb-9f3c-a79594b7ba4b", "sighting--9535f249-2264-4ac2-b812-eefefa12b535", "sighting--98c8fc81-c75c-437c-a0ac-5bf3d3efaca6", "sighting--448e47aa-e07b-4d72-a94d-74dfe5489934", "sighting--cab88976-cef0-4feb-9213-1f05581fa414", "sighting--7172bd38-c0a2-48d8-9c77-94d6455d6411", "sighting--a068e03f-71ad-4d90-9e83-a4c3b687d74e", "sighting--999fd6ca-a121-42ec-b102-8b8b5abdf373", "sighting--c9c3a248-803e-4c34-8558-60637b5d1749", "sighting--0032d8b5-d865-4329-8cfe-426c8f7bc68b", "sighting--d85356f6-51c6-4880-8c39-0ca6c6b4a0c0", "sighting--444f2d0f-5287-4428-9b00-2512f228ce45", "sighting--29f4eba3-1c30-4947-87a9-216626180931", "sighting--80e499a1-a681-40b2-96a3-6d2e7967057c", "sighting--a1ed2cc1-6e3a-41f7-b4d0-b3a54a2a3ee7", "sighting--ff39436f-f665-4ef4-a41d-ca26078a2dad", "sighting--644f1e0e-00f1-4980-bd96-d85c6ab6f770", "sighting--0d1ccb76-b647-4f5e-ba13-b09734507b82", "sighting--bbe17af2-3a96-473f-a62c-341b4a36c305", "sighting--ffe4f0a3-7f16-4150-97f4-4607d7c68688", "sighting--7d5c8ec1-eb1d-410d-9ac6-37043efffc98", "sighting--07f5eb83-7be8-4bfb-82a4-a7fc17a447a2", "sighting--23486ccd-c3bb-4ddb-a3b3-1a7426eeb409", "sighting--077cc122-a48c-48df-99f2-e16ee0c563c2", "sighting--140a2122-e622-4837-9fe2-662d7e088d55", "sighting--5ef0c379-05bd-4fb3-adad-d53f34bc0107", "sighting--70d171a0-2a4d-48d5-895b-ad5c7ba1ae18", "sighting--57d638d2-e640-4324-a18d-618615929d0b", "sighting--3f2693fc-8570-4ba8-9925-c2a8a4c1c676", "sighting--025bc6dc-dc21-422f-a4ac-30534bb12f14", "sighting--eb27fb76-b2b9-4fb5-979d-c363b95528bc", "sighting--c7963908-b72c-4fb7-979e-1c282648805e", "sighting--a04af15c-0fd4-4bb4-b1ae-7c7716d17d1b", "sighting--043ce28e-1d76-4e21-a6b6-d9d968e6fac3", "sighting--e23022b2-ebb1-454e-b6c2-cbd28d07cba0", "sighting--9d827fcb-5adf-4a36-974b-95b0a81daa1f", "sighting--a618f58a-e362-429a-8505-a74fd6dcf6dd", "sighting--7523ff17-b704-4b1f-8995-81c04e473515", "sighting--aeaba8f0-5cdb-4d12-a558-ab8d7a72b445", "sighting--ace57b3c-652f-49d0-b326-ab0fd120e2ca", "sighting--c8fb755a-c1e2-4e63-8b9b-70c99fcb6766", "sighting--ce88041f-1a31-4d93-b3d6-ad4de07f8328", "sighting--af811d39-9df7-4f9a-ae70-9dff485e6b4d", "sighting--4efea3c7-c3cc-4304-a6e1-65b7ede9ee5e", "sighting--7bff2458-6413-4131-9217-5a3d0ad93f68", "sighting--e4cc3fd7-bfae-464b-b685-1cc95ba5d5a0", "sighting--753c0096-7427-4a3a-a18c-977b69e60aaa", "sighting--f79ccaaf-e4aa-4a98-b0f9-1df6eae4b5db", "sighting--f79dc1ec-eeee-4885-9f3b-fb03fff06c9a", "sighting--e406403d-2fee-452d-88ff-340a43ef7bf5", "sighting--0cc925f6-ee6c-44db-9af0-b0d4c48c8d1b", "sighting--ab90dfe6-cfa0-4bb5-af91-77fde6d8b60b", "sighting--1f701dc7-1ceb-426b-94ff-bf87f173486e", "sighting--4ca9b7c1-ba5c-4f95-97d9-116d80aa5969", "sighting--3c23809e-900a-4c28-ac10-b66416a58608", "sighting--e2b79d5d-5b10-4be3-b06e-139e0c8913ea", "sighting--872d03c3-8275-42a9-9c0d-d9b4782f1edd", "sighting--4ef78e63-9504-45bf-aacb-f8a121edeeb9", "sighting--9224da3e-9a37-4a13-aec8-ecaefe52e45c", "sighting--be401837-1974-4fad-8279-f55ef7fea77b", "sighting--a01a7f4a-747f-4bcb-b26f-b203ba977304", "sighting--7ec8345f-0c4d-4064-b9a9-16df2a5c4112", "sighting--ab39a79f-13e4-4795-abec-4fd1bf3fa233", "sighting--7809e619-5d36-4913-a718-c210020b5f3a", "sighting--13c018be-f253-4be1-8c04-60ce5e524ccf", "sighting--00698829-71bb-4af2-88b9-791f5941995e", "sighting--7f57ceda-ad17-4d3a-bed1-5870fdb780a5", "sighting--986c64c2-f007-417b-bbe4-48fdcfacb7d1", "sighting--95f36005-d458-4dd5-92c7-8b32b2593826", "sighting--3b2f0acc-9c11-4ec9-93e0-5ae7dc7f41f8", "sighting--ebd1606f-e1c1-4d75-87c4-27284aa85615", "sighting--63a2c9c6-cb37-41df-bb45-9a99422cfdf5", "sighting--95329937-76e4-4777-8a69-438d3af98352", "sighting--99e4a173-8732-42f9-b0f9-c158c2268649", "sighting--89147c06-926f-45b5-a486-35282ba447f5", "sighting--d097d055-dd1f-4764-9302-ef684feb5fc4", "sighting--f10b7ebb-793a-4fad-81db-bff49a1982e8", "sighting--87dda626-e96e-4da5-b62c-f3ec76a2a4dc", "sighting--62292d6c-040f-45ee-8a31-4f2585a46cc9", "sighting--62d1b320-41c2-44dd-a506-c09979a85bc7", "sighting--47ba3c14-9144-4439-a949-a4644946096e", "sighting--7da1b5d2-d41f-40c6-a7ae-38e9439acaf1", "sighting--03e9dc4f-6323-4d3a-bab0-8fffc162af8b", "sighting--f8f3496e-99d2-4b52-8e4a-aa430a8c1b9d", "sighting--47c732cc-479a-4764-8a52-894e92003945", "sighting--09c7bc32-5b69-4894-b35d-19f51256b581", "sighting--a9221056-ea92-40a5-9ac4-ef96fa9f1a10", "sighting--2b64d223-5994-4922-af50-0f64dbdf8303", "sighting--3339fdf5-2e0b-4cc7-9760-630c76632ea8", "sighting--dfbaca06-4fdc-4a97-9afd-5381afe114f8", "sighting--5a6d8c2b-c2a8-487b-af38-9395a81c2e4d", "sighting--08e88401-d806-4f7c-b4b2-7031003c2132", "sighting--d62d84d7-0691-4bce-bbdf-b300653ead01", "sighting--09a5080a-8231-46ff-9f05-191bb0556139", "sighting--7ff60a1c-cfab-40f0-b829-8595fb3177a2", "sighting--c0481837-a5ad-4ea0-a836-2ccf2aa9d242", "sighting--cf4b9d6e-04a7-44b0-86c5-f576f126fd35", "sighting--3adaa65d-7855-437b-a1af-d90feb378b00", "sighting--dac4650f-029a-465a-8b63-c7b35da5d76c", "sighting--21ef4a0b-adc0-408a-9a4c-d8d723e9c032", "sighting--e09f35ac-9ce4-4663-888c-f269ab997c54", "sighting--b489c9a3-f472-4ccd-a713-29973060e958", "sighting--66cfcc8b-f417-4f5b-ba5c-e982c6500b02", "sighting--887607b7-1e35-4bdc-8ae3-0a2a5a1d716f", "sighting--e8ff72ac-5cbc-4c08-b85b-70ea133e49e9", "sighting--fc33c4bc-29f4-4870-8585-5b5737e94910", "sighting--2dec80e3-1484-4db5-b2b5-18747f1caa0b", "sighting--7b04e53a-b0c9-490c-b50a-dd11ba726a51", "sighting--e528dd2e-1b1e-475a-8a72-c3349846dd8a", "sighting--c85b6a4e-8d98-478e-bc30-20380862ab35", "sighting--4b4d5681-642d-471d-8e86-b50ca076b23f", "sighting--d3772824-c516-4d9b-8b63-da6cba89e9c8", "sighting--d7cc9365-cfdd-4e16-96f6-3e5b78246835", "sighting--37d62927-986a-4746-90d5-0b6a434616b3", "sighting--6f213788-9549-4b3a-bae4-edb56844b52a", "sighting--6d010cec-6261-4c44-a228-2295a870587a", "sighting--f7cd4aeb-301d-4eb0-a697-59f959b57f4b", "sighting--33563223-5e3b-486e-8d65-b6d74f94d3bc", "sighting--ca70b8c7-b3a7-4a99-8ef3-7c557b6ee102", "sighting--704bc4a8-7a2b-47ed-93e5-01198a0633ed", "sighting--00e9c7b6-0ac7-44e2-b8ae-2da1f85462ef", "sighting--f450dde5-b0de-4824-b5ad-a451eaaa0b16", "sighting--16a62107-e952-4206-95b7-d26709203884", "sighting--8bdf226c-c908-4a72-b2cc-c2a3e285ea5e", "sighting--ed825235-c116-453a-a588-ac9c525f177b", "sighting--181f5dce-02b4-4f86-8230-32e1e8e3a735", "sighting--809c2a7c-ea91-4eb9-a258-a088b2cf889d", "sighting--d94c8c9d-6ddb-4474-816b-cd2c0b84fbfa", "sighting--de6c64af-a864-4b23-b443-1c27bc7faec3", "sighting--1d11a005-1430-4b66-8025-fa27af454772", "sighting--0f0a8985-9988-42b4-a019-5558b4b044d7", "sighting--935f48af-b4e1-4c9e-acd8-88b32f1eb0d6", "sighting--7ae300b6-0996-412b-b353-4ac89ca6307c", "sighting--a898e9b1-6cb6-487d-afcf-96bc42203d54", "sighting--be6dc46b-9ce3-4d45-94ea-00745922e2b1", "sighting--813d835f-36c8-43f0-a229-19c881046e63", "sighting--1aa92ed4-8c4f-4e43-a0a3-80f62ca96f3c", "sighting--adf82f26-9984-4b37-b58a-57a5038e2024", "sighting--4f1579b7-1c4b-4c6e-aa4f-36d3f8e26f4f", "sighting--6019a65d-e28f-452f-954a-8e04a96f159a", "sighting--68ba6ac8-783f-44f9-93ca-a1f6f131dff0", "sighting--3d428884-89ce-47d7-9cbb-e61c966e4398", "sighting--6e316b39-2150-4cee-93ea-8c738ec88d51", "sighting--c3cd7c70-935b-434a-a233-60a8824a4587", "sighting--17fafe77-51c1-4f00-9659-49d5583d2e36", "sighting--70f144db-bcd3-4923-9081-831daffa0a8d", "sighting--15dc0d70-3d27-48c5-995c-30d01c776d72", "sighting--5326f87b-b1e3-4b4f-aac2-eb6884f31e09", "sighting--7fd1e236-e06e-46dd-80c4-d2899408ea91", "sighting--9ccd59e1-1a19-4a32-88d6-13c33998798f", "sighting--3caafaf4-0971-449b-8884-511dfa60ab23", "sighting--2028109c-a495-4555-8f09-ef24229f0f5c", "sighting--a3f0b5d6-f6f6-4dff-a698-406ebe3aeae9", "sighting--ef57d011-bdbe-4fed-a20f-2c27e42e3c4b", "sighting--49cd4b63-3e5f-4646-84de-efffd51a2eba", "sighting--85dbb0ef-cf83-44a7-a991-6bb3c48bb803", "sighting--41b61f8b-8e12-4e34-aae5-29bd75c560e1", "sighting--4ef3ad44-55ba-46a6-9a27-0227de3356ab", "sighting--1a6a146a-70de-4901-905e-8eb10ac760d2", "sighting--595bdc84-f112-448d-b3f4-bd7cb701e6f8", "sighting--43bd9216-fdc9-4d5a-80a1-c4df41430d0a", "sighting--4469d209-4a2a-4616-8be8-68c7a6c8d5f9", "sighting--aa4db277-e119-4789-9f99-9c155f0d98e8", "sighting--db4181aa-4f69-4f7c-b283-9772aa34a431", "sighting--6de02e4c-baaa-4033-8cc2-a0bd22aeb479", "sighting--3ba47a66-73b0-4fe9-a975-c8cce62755da", "sighting--4e365b15-dc15-4ae9-9dd4-9e14b234bc48", "sighting--2816d3dc-1cd7-4c94-aa55-926a94f989a0", "sighting--dbc7ef42-d75c-4f57-bdbb-93ce736592ef", "sighting--a7e0f373-1378-4d7c-9e3d-bc312988a696", "sighting--9910f734-4e33-448d-80c4-aac61100197f", "sighting--757ce7e0-8607-4f9c-894e-a1800d763056", "sighting--c6137c18-d364-4417-b238-bc2854dd7a2f", "sighting--3641e411-3664-4ae2-a56e-f3e063b38191", "sighting--3ba3d8b9-609a-48d0-aff4-94a37b516d4f", "sighting--200dfe94-e95c-48cd-a6a4-b9cf71c985f2", "sighting--5495c35f-3cb7-4ec1-a684-aabfd3eceba5", "sighting--974abe7e-936b-46c2-9cbc-d485e150349e", "sighting--3f7e9463-74a1-46e7-a6fa-6dad4834e523", "sighting--947571d5-dbfc-4f8c-b81a-4883a66a879d", "sighting--f01fda46-8ff7-486b-8fc7-455be9878f67", "sighting--34019a1d-5962-4eaf-8429-0d45fe40ae93", "sighting--55e9a8e4-69fc-4e1f-b1e4-05ad9157c938", "sighting--124c2bd9-464d-44b3-b95c-3bd46b33cd1c", "sighting--8ecb7475-46f4-49ed-9a7b-c99ce6e5dfb1", "sighting--5d0b581e-0430-478a-9df5-a7cfaa074460", "sighting--1aa49f2d-183e-485e-9c00-3513d3c4ffe7", "sighting--3a442ef7-a2ee-41ea-8ba5-44d76afc02a1", "sighting--e497eab0-ca00-4204-bf18-67721917ebad", "sighting--ac63391c-8a77-4cb9-9b42-253cd15eb495", "sighting--664a37f8-264f-433d-a25a-98d54b29f35e", "sighting--301cb86c-18b3-4caf-af0e-ff669e00e67a", "sighting--e1b2b8be-058d-4cf4-8c3c-7e2fe08106a0", "sighting--1c276c3d-dd95-48ad-a21f-c0c1a124fd2a", "sighting--72c108a9-f5e2-4a59-8c50-91ec1e85090f", "sighting--cd263398-2165-4e11-b957-16ca10efe14b", "sighting--30d2388b-ee9d-4049-8ea8-4d59b2fb0d21", "sighting--8f1bfac2-1f19-4c14-9315-772d49e21a0a", "sighting--0f12f490-4242-467a-b857-b2a90c458842", "sighting--45383e62-9703-455e-a5d3-7cc2bb917205", "sighting--4cb36765-5d0d-44b4-b3a6-3c94acc9bfd1", "sighting--a69f54c4-8a86-46cf-a062-53c4229c64a1", "sighting--02b37959-0cbf-436e-81cd-0ef8214fff43", "sighting--d7901557-a2e6-4240-9278-5de402d31cfb", "sighting--2975814c-de7a-4276-9229-8cf14c3eda01", "sighting--0e1e580e-6ed8-4df9-a5e1-0817811ad02f", "sighting--dff6ce01-da8b-4f36-929b-3ae06d687cf0", "sighting--0a312d4b-ffc3-499e-9be5-37aa454c2a0b", "sighting--4f5ab3ab-27c1-4096-a839-0b338e01bb2c", "sighting--45326e06-9700-4e4d-8e2c-b94f49495210", "sighting--f02bd58e-b3fa-4741-8f4d-3dd9d2437a71", "sighting--ffe6984e-706b-4413-8934-f1b41b27d0c4", "sighting--291d57a1-861c-4401-8522-fd3ce6e80188", "sighting--94969f34-a868-4b85-a313-db15a6ee79f2", "sighting--750c888b-c696-470a-8af6-2e1fc0500213", "sighting--819101b1-91ea-4cef-81a4-30f7abdfb161", "sighting--eae2593d-b729-4fb5-9c86-49cb9731aaac", "sighting--d4a02725-0ad0-4205-bfcc-33bcf76eb4b2", "sighting--5b5c4937-925c-4e93-9392-8049ce3b3a4a", "sighting--8fb64e60-1cb3-48f5-803b-1410fb4bd20b", "sighting--f369853f-5974-4545-8e41-ebf5e1dd389f", "sighting--f5b30a6b-080f-4c05-812f-8e7af733d612", "sighting--ec35ce19-b9f5-4c44-ac0e-854e732a038f", "sighting--5f466fbc-84e7-4c7f-b922-93ce2e45cf76", "sighting--994f576f-514a-432e-b5d1-8e1458d9945e", "sighting--4ea56728-abdb-42aa-a6dc-ced3e3905735", "sighting--2eae8094-17b4-423b-a625-92450d6d6e51", "sighting--2fba92cd-81ac-4505-82c6-a5b5a3a177b5", "sighting--27ea994d-083c-4a62-92a9-111cbb435f33", "sighting--e6df95c7-a8d8-46ab-906f-ec406c10c2b6", "sighting--f86779e0-0159-4688-99b1-48f28514dd6b", "sighting--6a821e28-24d6-44fa-8429-38f5d506ed1a", "sighting--f5888ef5-2ea8-4d97-8d42-09e2d185216e", "sighting--2c9af1a6-80b4-4421-b3c2-2627708e04c0", "sighting--d11d57a3-0c56-43c0-9876-c1d94fb9512b", "sighting--96bbb84e-0db6-412a-916a-5ebec2d914be", "sighting--079fa96a-f893-4b57-929e-a5f44bdffef3", "sighting--c3569a88-d911-41fe-ad0d-4ec8f07121b8", "sighting--f94cc0b9-fc3a-400b-841f-063c3200e8b0", "sighting--94d43ff4-65af-4215-98aa-bfb91abf1539", "sighting--c9680b38-f91e-4ebe-8b4c-02962f1241d0", "sighting--90df0697-a176-4a88-a50f-197f2407a52a", "sighting--e5e6da33-1b56-44e5-abc4-6ccc893ddbcf", "sighting--cdfe512e-183b-46b0-89ff-28bf70e20afd", "sighting--27640d2b-4db3-4b7f-94b2-b6c7c4d596ba", "sighting--99496185-5962-4bda-a4da-38eb0c3b1ce1", "sighting--ae77d7c5-2ca9-49a6-a9f2-244edcf1f6f1", "sighting--c3a11932-b2ab-4237-a51c-33b0a9ad4ebc", "sighting--ec376102-a829-4e9f-a38c-5c76ba27643e", "sighting--59634048-4041-4817-9ca1-378da0920a73", "sighting--237e34c0-b77d-4737-8b9c-140f891d0cee", "sighting--c7344f47-7ea8-41fc-837e-322465c3920c", "sighting--f945591e-ca0c-4200-b20b-b837488e470f", "sighting--9f3ab05b-3ec1-40d4-8c77-a316df5f4d60", "sighting--0e05bb79-527a-417f-823a-0059667bca73", "sighting--f1d48291-795c-4509-9406-f14771396829", "sighting--ab55c54b-233a-42f3-bd0a-0e9c6bdb856e", "sighting--b7dafc31-64bd-42e2-b58b-ecd4593c1a67", "sighting--caae1359-09dc-4133-9f7c-54a9b051b132", "sighting--c76201de-c46e-495c-bb40-0060e8a44052", "sighting--7edfc16d-a91a-42c2-b60b-ef5e9ec8bd5e", "sighting--bc0a19e6-2619-4495-a5f9-b9c1a8d13199", "sighting--08100624-91a3-4d9e-8ce5-5ac7251028a8", "sighting--a651e155-0ce0-4f99-957b-b69910abf725", "sighting--f04d51ab-870b-4c4b-8f9a-d049ecc75b72", "sighting--c2f3054a-2d5b-4e94-9bc5-b2b8d54c9eb5", "sighting--e0678817-d0ff-4215-ad88-1514147877f4", "sighting--fd464d2e-d652-4452-8afe-ebd6ea311da1", "sighting--2fdb1dbe-ad60-4fc1-9f8c-050b37b847bd", "sighting--1248608d-f203-4b09-8089-66d17d25e003", "sighting--28c66f3d-41e7-4fb2-a638-ca7535182a93", "sighting--5619cc0b-0484-4803-8470-0fb96f4a9c26", "sighting--9c251fa0-b6ff-4d21-9e60-cb81e939e501", "sighting--1e493950-271b-491a-a585-876a56105685", "sighting--b80a6520-05eb-4be9-8ce4-06cbacd77037", "sighting--6b228f8c-c2a2-47fe-8c2e-64ff36c02d00", "sighting--1c249c73-c3d5-4f26-9ad0-83d5be2b58fe", "sighting--b9e6603f-cc8f-4555-81cf-52d269012a1f", "sighting--55ce8448-c8d2-4933-9f59-e0f8dd1b465f", "sighting--3de5bd71-7b79-468b-bba8-e1f5d3c32639", "sighting--20bb23d9-ab71-4bb7-a7d7-661da9659f5c", "sighting--81cee2f9-0702-4468-9fc9-ac90406fe915", "sighting--d915d50d-fab2-4d5b-b708-c691a5da7ed1", "sighting--6902546e-4406-4af5-bca7-94a3f78e1407", "sighting--2f3d4cbf-d312-48d8-a34a-490575fb4513", "sighting--02ce4940-9d55-4a39-af14-9bd563068bee", "sighting--04c33cf3-609d-436c-ab2b-db3ebfb1e29d", "sighting--262cf7d3-66a1-4c33-b58d-ba991da99751", "sighting--657bcc69-e2b4-4774-8164-e73cefe76b0e", "sighting--abc66b75-6af8-4823-b152-6173d209c4ce", "sighting--61315815-38ce-4f0e-bd8f-698fe00b0564", "sighting--6ef45f04-688e-4a29-a63f-a4f4f67c4acb", "sighting--e1fcfb08-d309-4839-959a-083b84213ed2", "sighting--b9e75b70-7703-488f-a95c-5b6f386bfc15", "sighting--701eba3c-95dc-4de1-9f23-bdc34f61d13f", "sighting--a1843a5a-0294-485f-894d-9f2773fea3ef", "sighting--4b6cee88-cdf6-432b-bdc3-a39922b6b393", "sighting--35d70365-7358-44bb-9d99-9fb8a3337dd3", "sighting--a5e019b5-12f0-4bad-8bd3-85d090cc7564", "sighting--6b17e2e5-45c4-4183-968b-e498b3100326", "sighting--3cd56315-aa47-4750-a5a3-23aa3d3d08da", "sighting--29769942-3a21-456d-8196-61407faac167", "sighting--556e4a08-cfa6-43ce-ba81-1921d87600b1", "sighting--579007bd-66fb-4799-8bac-f64dc1c9757e", "sighting--66654351-be09-4470-9cc2-ade4fff01312", "sighting--7d0443e5-4d0a-4786-882c-0ccdacaeed8c", "sighting--a1d27b8e-510c-4621-bc47-72ebeeb5f2a9", "sighting--af7456bb-7a0f-46f5-8b71-5470746b2c14", "sighting--f0364173-fa26-47ba-b33f-61044df429bf", "sighting--fc6887cf-248a-4231-9ebf-878aca949a88", "sighting--c7a06b2f-f8c0-46af-b300-f7805cd2685a", "sighting--e3c7b105-37fc-4e8a-bfe0-4745259260e2", "sighting--a2571ef8-7b44-4166-a041-f90010721000", "sighting--67a4e085-acc4-4507-8ad0-919c33eafbf0", "sighting--b73f09c0-6e3c-4e12-94b1-108fea5da509", "sighting--dfa3b234-71d4-4ffc-baab-dd8b9035e221", "sighting--bfd4d337-e968-47a5-bd00-abb054b09672", "sighting--8c5f5177-b0f8-4d09-be6e-ee3577ae3133", "sighting--1b6c27a8-54e9-479c-bbc0-8b981ef55cfe", "sighting--5efeb8d7-a677-4e2b-8662-da8c614d659a", "sighting--8f56d992-df81-4b20-9cb9-0003d35767dd", "sighting--4a44204b-e679-4735-b801-8ffdbfdcf45d", "sighting--313e8b7c-c396-46b2-bd74-c1fa26fa1844", "sighting--5eee67ed-8daf-4512-beda-9982747bd0fe", "sighting--5272c65e-0a10-4841-969a-17a201cc3c7e", "sighting--af058937-1006-4d84-91c2-bcff57884b02", "sighting--8051b32a-0e55-45ba-b2ef-e8e672facc85", "sighting--8b50af17-ec37-44c5-aff3-f43a595c3376", "sighting--cdb68fbd-2324-4aa4-a13c-7ca7d3ebb630", "sighting--05db8107-a7bb-4b81-8b94-5c266a3b0b57", "sighting--3b5806fe-7d53-46a6-8c0a-da938fa17a6f", "sighting--a9593f50-5080-4b1d-a9e6-76a12af55ce1", "sighting--d53211f9-49e1-4f96-8b7d-73ed0e5be090", "sighting--184261e4-1248-4b1f-af5c-50ba5330dacd", "sighting--87b40a17-5890-4960-bc41-a71a4221e8e4", "sighting--7f10c5e0-a66d-4c25-a726-9153fd0774b2", "sighting--dba83f80-c5a7-4c5a-83c8-3cbb3dd788e1", "sighting--f298fece-881f-4791-9edd-c5b2ad6d7d08", "sighting--45cd48eb-9656-4768-9017-dde9c209efba", "sighting--371f3485-39d8-44a5-b512-78f9f5398b7b", "sighting--1e86a069-542b-42e4-ae86-56ea8f34bf62", "sighting--cce66652-2f8a-42bc-b984-ce1a25e8b49e", "sighting--344fcf60-9de4-48ed-b399-bbefcb6583e5", "sighting--2fffe314-10f8-494b-9daa-d9bebc108116", "sighting--8f425894-0aa8-4938-a33a-6d1ef7c1a687", "sighting--919814c8-c393-45af-87db-d0a025a88e7d", "sighting--f276897c-000e-46c6-84ce-bb7751fdca66", "sighting--3aed3c88-76a7-41fa-b25c-8fac919d5a37", "sighting--70681ddb-826c-4f63-a8ae-7651bc019df1", "sighting--7a433da6-73f9-407b-a8d2-fadb48754ca4", "sighting--b6e6326d-012d-46c9-a44f-b09be03ced00", "sighting--8ee6941c-bbba-4493-9e35-995f41dcd30e", "sighting--d1d31081-ee49-4d7b-9a18-45a2679c3514", "sighting--98de2313-9ad1-46b8-98ae-4a368f264df3", "sighting--ceb96d5f-3e9a-46eb-b53f-8d1a3f63a205", "sighting--ca0d9df4-73a7-42a5-bf8e-e876a57bb6ae", "sighting--fab0907e-bac6-407b-8d45-a9532f3e61d8", "sighting--9f7d2f3f-f9f9-4645-929d-5ff3edc85325", "sighting--687f1c3f-b075-467e-aca4-68eb797bc34f", "sighting--aa5ed2d8-0c1a-47b8-ad9d-d28b51649111", "sighting--059f3037-9116-4f6e-903f-0f4c6f69c9c2", "sighting--ed8ce436-c48f-47d1-b861-96bc5cf43899", "sighting--753436f9-d2f6-477f-b632-590882e4c17c", "sighting--398498c3-53b7-4cca-9e3f-6027dd3a1e04", "sighting--6533aa7e-47ad-4e27-a006-46ec7c91f636", "sighting--eff19c8a-1218-4801-a7c6-65de5565a61e", "sighting--afdf72ce-98b0-478a-a8cf-81603fa97d54", "sighting--769bacfe-87f5-4ca2-8a66-e38627e108d9", "sighting--f2aaa822-3103-4662-84e3-5f8a0e8bc648", "sighting--f5850f94-4ca8-41e0-98d9-cfa05611a5f5", "sighting--65b338a8-508d-40c0-97f3-fcd96cf69dc5", "sighting--8fc96f65-1af0-4c6c-8e9a-b65822e191cf", "sighting--8375d78b-b718-4680-82be-4167e440919c", "sighting--6eac16a0-543f-416e-aadc-e27df0440877", "sighting--826e9dc7-4f7a-480f-849e-0dcae6beed53", "sighting--d7babdda-b9fc-45f5-a7ac-86aecce930c6", "sighting--c886a96e-7b08-41c1-9baa-0861e0547477", "sighting--4dc948a9-7d69-4d4e-90e0-85c6eaf7e77a", "sighting--4057d870-8126-459e-9c1f-971ac0766ed5", "sighting--c9fa0e11-a2cd-4920-8b74-d97b9b5d41b4", "sighting--7bf77396-f4c5-432c-aa48-4e212da17c7b", "sighting--756ffc9b-b82e-4774-bb57-48b703f2e492", "sighting--d8e2f350-eef7-4fea-a00e-f327497895d6", "sighting--1f73e659-31a7-4d43-b448-a0fbca256ed4", "sighting--869c91b9-025b-4b32-9c66-d8fdfc007ff0", "sighting--b84808cf-dbc7-425c-94f3-bdfb2404994a", "sighting--0cc33f9c-871a-4b74-8c66-abd1c2f4589b", "sighting--50b0ed0d-1787-4b23-8c0d-e97f4ae150bc", "sighting--6127c482-4f0d-44a9-8236-04b97794a796", "sighting--ef1e8e16-8c76-46e3-b2ea-da90540eed48", "sighting--f1da6f2c-806c-497c-a4c1-2a4047de5f90", "sighting--cbdd25f1-be75-4c12-aa4a-37ae51dc9364", "sighting--42c15728-f47c-4e83-81e6-e016a48c9ff4", "sighting--13a936a9-a117-490d-8a47-44aa6ef8bede", "sighting--29afe3b6-6195-46a1-bb7f-2ab37f8e86a7", "sighting--c8d3e07f-6934-4660-ba81-f5ea0f58418c", "sighting--820d33f3-f47d-4e16-b59e-7a9d65391827", "sighting--19c421cb-15a3-4486-8849-722e4ad45bcc", "sighting--8974de31-fdfb-4982-8540-c9ba0aef4522", "sighting--6e2c33ab-dc68-48ce-8a64-f489cd324131", "sighting--58cef9c9-4393-40d7-af13-a37647734d27", "sighting--a0e99ca6-dd91-4e9e-b7c6-48381aee1372", "sighting--ed135246-87a9-42d9-97af-8c51636205a9", "sighting--c9afa44e-976d-45aa-9eb4-7c73d9f2f906", "sighting--1a541011-3501-4d72-b3b3-ebaffc285554", "sighting--a5480b9e-3342-4f63-990f-d809130b2ec0", "sighting--bc3f0965-2d7a-4470-a5e0-f9644682dcad", "sighting--8ac32bc1-49a3-40fe-a0b2-637fa71c7151", "sighting--9ca5ce54-602f-4979-8fce-cce8b9acc32c", "sighting--94a905bf-2b53-4152-81a4-c71b790fe439", "sighting--7d209690-733d-4eb0-8891-e5731c028da1", "sighting--71573960-011e-4486-a36d-70b6a47ac601", "sighting--e30a0e5b-a3d5-46ff-b3f2-9a95c28a479d", "sighting--67c4bfae-af45-4544-a3fe-8cac2475ca96", "sighting--917ac466-92c0-43be-9361-2cc170b79e50", "sighting--436e5c5a-f162-4acd-a08d-412760da908d", "sighting--1bad05e6-0cc6-4646-bb63-b1e737a3b8ae", "sighting--38bf6d08-10f5-4b26-bf0b-eab43fbece2b", "sighting--2c0d1c90-57e6-482a-85ce-cd54ef5ac07d", "sighting--6e18ca6b-3ad3-4f4d-9d0b-319915282927", "sighting--37ffef57-cab7-4bc3-a46a-3a5f2988e8a1", "sighting--87851032-962c-4773-beb8-004a5b993073", "sighting--f7cebc0f-f8f7-4988-9421-ecd3e00f1ff7", "sighting--64fc49cd-cd71-46a4-b514-d6ed14d7b7ba", "sighting--173be7df-b631-4d55-a111-71b6d1938a88", "sighting--533dcf51-91a9-49dd-9d08-9d5df3877846", "sighting--f0c3fe1e-b825-4255-945f-e60c012c51e0", "sighting--5f5af426-231f-465c-bbcf-8f1f3f88d472", "sighting--c4e4d85a-29cc-4b87-bef9-d527222e221e", "sighting--8dfeab1e-afb9-4268-b5e0-d91ffa5461e7", "sighting--7d772435-0af0-4466-ab3a-6a865e13a115", "sighting--19d377e3-b71c-4800-b351-822016b5a86f", "sighting--f48d4e7d-46a8-4c8c-b6e1-65a5e6cb6421", "sighting--3345f287-9b56-43bd-9d64-cae644d89623", "sighting--b3af78cc-fde1-4b57-8104-e14a49d7d99f", "sighting--2af2186c-9d52-4a66-88de-99f319af14c8", "sighting--aa3e1978-c5f4-4dc9-91c9-95baa0f60d98", "sighting--3427dff1-93ea-4830-8209-fdf7c3278b40", "sighting--e63fc759-8ebf-4502-90bf-a2b203027761", "sighting--54ac8180-37c7-49af-8c63-757dbbcd7fff", "sighting--3d23f1d9-53a3-47df-a7ed-d7cc3aaf511d", "sighting--552462e7-9c4b-4a06-8b39-0774a385b78b", "sighting--8605dadd-6c8d-4f74-af4c-c3c915ef4b0f", "sighting--b96cb6e4-dba2-42b6-935c-8d3679442cd0", "sighting--34b992ea-f50d-4a66-8970-15872337a8ea", "sighting--cee61518-4f0b-4844-900f-0caf01046472", "sighting--9c32ffe0-a082-4c7f-9a33-48a9df9a4ede", "sighting--cab68c36-2bb7-4e0a-97e0-3136bb0a174c", "sighting--37ed4871-7c71-48d6-be2a-4b47c1df2bec", "sighting--474acd36-1e97-496d-b8ae-eee2599951b3", "sighting--7daf9381-9c9d-4b21-ba8e-663aeb368f2d", "sighting--19bc4381-e4f6-439c-ba48-d11881c83d04", "sighting--b73c73bf-1164-489c-a7c0-4126622305e9", "sighting--a9f5117a-ee1d-443c-a62c-2a97c1ff3ff4", "sighting--5ba4df87-8b68-4cf0-85c8-80926cba62cf", "sighting--4441cfeb-2074-4803-887e-3fedf27ff0bc", "sighting--e00e57ef-e8c4-42cf-ad1e-168e1f96e565", "sighting--c023dfdb-2f82-4f26-82eb-94a1a392ccad", "sighting--3cc7921b-e07e-4ace-8d1e-0a423fd38dd4", "sighting--7bed55f9-ec56-481d-8a8f-71cb9b508e69", "sighting--fd45b8d0-e320-45c6-872f-dafbc09d6bf0", "sighting--c47f726d-7936-489e-99f4-182d685743c3", "sighting--760047de-87d5-40c8-9af8-694ec1616207", "sighting--8a63947c-3c9b-43bc-a610-14bf0643002c", "sighting--4554fcaf-6291-4ec1-b0c9-d9d123e8a9bc", "sighting--59eff6f5-2df3-410c-9121-431fae02f13c", "sighting--0c08a6ae-1969-4add-ab94-58bc1690e0cb", "sighting--a8f5c655-e7d0-4415-9063-f86f3f4516dc", "sighting--164e73b2-b26b-4c51-a1e0-710d5735be4b", "sighting--b63d7075-ece6-4666-a6b3-9f303df07ab6", "sighting--16a03c88-39e9-422e-8b92-33b26f575036", "sighting--f0aa2708-d2bc-44f1-8365-5dfdde041faf", "sighting--47da11a1-3c33-443a-84ba-0b5964cb77fd", "sighting--d5edacdd-29b3-4704-bb4f-eb39070f9d81", "sighting--76432080-5097-408e-bca9-b438b9586e4b", "sighting--cb115833-99ad-4ee5-9241-6ecc7d96b56c", "sighting--1ef0135a-d4df-48ca-beef-b492f180f54b", "sighting--31d6edd4-da13-4df5-97ef-ded14b443542", "sighting--9437cddc-70c9-42db-a424-334720f5de07", "sighting--0e2a9f4e-7953-4e47-baea-6639a46e60c7", "sighting--8252c010-3992-49e5-ba0a-b986c3df8781", "sighting--2fc50616-7c56-4a15-aea4-6c17d5d07cef", "sighting--775a5a0d-3ab4-4686-ac24-a2e9e46260a6", "sighting--386ca2f3-b5f0-4344-809c-c4775b336de6", "sighting--06dd189f-4254-47b0-bbac-a770f866d94e", "sighting--44a3cb25-c974-490d-872a-4c6f720510a9", "sighting--270fb71e-16c8-4704-8be4-659d0ca1c449", "sighting--6b158d8a-4766-40ac-b12d-06d728a01f09", "sighting--28e9d092-86cf-49bd-b8a3-9bc36096c463", "sighting--141efbee-c7eb-4c26-b284-274644ddd3ce", "sighting--b6f40260-63c6-49cf-98a6-593bfa9ab8b6", "sighting--98f9d296-f358-4449-9d12-6b6f3abe6353", "sighting--d1a5c026-9b4f-4b59-a220-cb48c853f431", "sighting--a439a1ea-edbe-4870-89d2-fc9b7a5242e1", "sighting--af2a1ed7-b953-4ae4-aea1-1cd41caab28d", "sighting--8843ddc2-d458-4407-a9a5-d987cc7848c4", "sighting--be6ad798-f0fd-4fb4-beda-ce59795df667", "sighting--08f93512-344b-4827-8901-2c1156c0c53a", "sighting--11a43ebd-18c1-4aa0-a168-1af8d0d6701c", "sighting--213f9673-ecb6-4248-8041-dc0eed70d801", "sighting--5fac591a-b702-463c-b166-01346404cc3a", "sighting--e55cb3c1-5ef7-4a8d-ad54-449ac61aa8ce", "sighting--fa5e0d25-145d-4638-bb27-6eb3bebdc3bf", "sighting--1d4ee06e-9497-4cfc-9a22-31e969f1c694", "sighting--78b0ab9e-63ca-4018-b6b1-3610c501b5d8", "sighting--957f3d5b-da5c-4de3-86d4-62526397a937", "sighting--41f10e6a-07ee-476c-bef6-8e8c44054f8c", "sighting--a3c9954b-c981-4f3e-9b05-62217209edb6", "sighting--3457c536-815a-45b7-86f5-13a721ab0fb8", "sighting--3024eca8-47f5-423c-8099-1d29432e9f7f", "sighting--7fa2419b-ad74-4c6d-babf-c874f48d8c11", "sighting--d4db0179-e83a-420c-92c4-731072aee447", "sighting--e7b9431d-33cb-446a-9ac4-00331207e6bf", "sighting--349e16e7-a707-47c0-be05-5d37178b770f", "sighting--6b1c0d1c-eed2-460b-89dd-f6dd2d0c68ec", "sighting--07c3f534-45c3-4fa6-8921-3b6a14722179", "sighting--3f27b846-9801-4885-be72-d11c32b9d717", "sighting--a96c01be-984f-47c9-90ed-4cf89b9e0ada", "sighting--410cff34-6a11-4514-b28f-816b071bc331", "sighting--d70499ba-6637-43ad-a553-dd7122f0cce3", "sighting--28486cf7-d31f-4819-a1de-e28543c7604f", "sighting--54df80e3-db6e-49b3-bec2-37263cb82e91", "sighting--dea80c2e-26ca-4c4b-a75c-413f67051e82", "sighting--36d5a986-42fb-49e7-8f3f-f4abc72be12a", "sighting--98cabace-0a6e-4f7a-bf89-67c844511f37", "sighting--930c66ca-d8e1-4ec5-9973-8159fa330b18", "sighting--50faaeef-f378-4bd7-91d1-aee25f20021f", "sighting--a97b126d-b7b6-49c2-9c35-c01c4da69f69", "sighting--134ff400-3c4d-4546-b929-ab699232800a", "sighting--87f87b38-5da8-4e77-b9e7-57c684ee6703", "sighting--61c66d23-c6d0-48e2-8e56-a1f508d4390f", "sighting--85b869ca-3916-4c3c-ae91-90cc60f46e7e", "sighting--7e067e42-94e8-4d21-8329-6dae9893e25d", "sighting--349238fe-c99d-4530-b880-ee0add1fb115", "sighting--ee75a0fa-d24d-425f-bb7a-17f3bb14f604", "sighting--b8736788-ce03-4df5-831d-5e2d3cfb6843", "sighting--dc8c2eb3-04e2-4b0d-81ab-c076d8f6f7ce", "sighting--a84ab058-66ee-4883-ae03-86ba70cb3126", "sighting--2a5779f5-3c3a-4204-9600-0be54ddf4acb", "sighting--a73ea86c-95e1-4f18-a242-23edb6a43724", "sighting--f601214f-4ea2-4649-9f5c-6472d780e112", "sighting--5071d0a1-893b-49f7-a6ae-8e912444755d", "sighting--38c8abc9-b81c-47e0-808f-ae7cbb88d642", "sighting--474dc2cc-d8ff-4e66-9273-c90c2fe2e3a9", "sighting--8f5e2f70-1d40-4a76-a659-f84a53842490", "sighting--21bad5c8-c2cd-4ca3-b121-88b5e512d251", "sighting--58a7b733-15f9-471d-8955-40563da6bb6b", "sighting--beee2483-8943-4d91-b163-955125d802e3", "sighting--051ca95a-eba0-4aed-948a-0cb1f079f628", "sighting--175e5ed0-a8c7-437d-880a-160fae0c247f", "sighting--d1ec21df-7594-44c9-bc4a-9ac33a7ae688", "sighting--f6adde2c-a1d8-483b-9953-b9d9758daab2", "sighting--ec1b702d-ec21-40e7-a49b-c5a8e1b2ce40", "sighting--77650e8d-55ad-47ce-aa5f-f0618029afaa", "sighting--f5563b3b-7aab-415c-96e8-cb654ed29182", "sighting--58cf44f5-f1d9-457c-b023-86dbe52d6eda", "sighting--185c31f4-ce6c-42fd-a662-143179992b4e", "sighting--5f5245bb-557c-4d35-86cf-1370a2361f3a", "sighting--04c1b771-311e-48ff-bd83-698528a29d8d", "sighting--b56a0c93-eeba-4d04-b288-e8b8ec918c7b", "sighting--cd3104e9-223a-440a-8609-50ff245854ef", "sighting--26cd3164-9e1c-4e9b-990e-28c7defd0350", "sighting--e1bd888e-d9e0-48e3-a00e-19b0272b5db8", "sighting--9346c8de-d22b-41c5-9b2f-462d4528da09", "sighting--908d688d-d794-44f1-8be8-f0b0c7ac7739", "sighting--7056893f-a14f-4ae7-ab2c-0c877d6d875f", "sighting--8de63790-844d-4726-ac45-6cb20c2c0b93", "sighting--4a577147-f7ed-4179-b502-7d8541055ef1", "sighting--e17b70c7-a0c7-41fc-9b6a-669fdbb30a39", "sighting--c1a9344f-655c-4f83-a895-5271da423016", "sighting--e28041c6-eaae-4b92-be55-a6d03c50ba94", "sighting--97616e67-8b82-4b47-a838-01727cc9569f", "sighting--25c8ea7c-6790-4b71-a1f2-423e792f7606", "sighting--b8d08a47-c058-4e86-8c4b-8b9366987ecb", "sighting--98217d6c-de4e-4d39-9dfe-66e1d5b9c27a", "sighting--ea36d9d8-4d77-4257-a9fe-895b8e1c2736", "sighting--727bcf1d-ee38-415e-9d00-cdc39254bac0", "sighting--0ec0c27c-98f0-458b-9a79-3d16618cf086", "sighting--eec88120-f1d0-4f74-b982-26c76ae0e28f", "sighting--46713705-5d7c-4ef8-b62c-8ec2d1b02973", "sighting--ce528391-2b65-4aa5-8aae-578a2d062ce8", "sighting--6594d47c-c399-4ce8-b435-e71febed9130", "sighting--25b31adb-5afe-4f45-bcdf-5e4a49e4352b", "sighting--da712eb7-8d86-47b5-961f-952f4703d4e6", "sighting--66369e6d-f4b8-4350-99bc-eaa3ca3a5f15", "sighting--46784af4-f298-4940-ad9e-232ce2dfca75", "sighting--a598883c-7b62-4b4a-bb8f-78ef635769c8", "sighting--e73006cd-84fd-4c49-b803-62190563c626", "sighting--90d16731-fa79-4aa7-b61d-9919de0a9969", "sighting--61882630-9773-4329-b374-ce4fddd62c85", "sighting--6d0ff7c8-2372-4657-b8ce-1012c6ea0f9f", "sighting--48eaa00b-ee81-4dca-b939-4c8248547b76", "sighting--660a8554-5120-4f3e-9f2a-022b0e1aac79", "sighting--fe6a2823-8dd5-4f67-a8b4-4a38ead94804", "sighting--039d44a8-1911-492a-a1f6-04e8bf81547c", "sighting--460548c8-dc8c-40cb-98e6-a64c40b13595", "sighting--1836b842-612e-4ca0-af5d-922ebbe8aa23", "sighting--b2461afc-90d8-4279-9dc6-be5982afecb9", "sighting--59e44d3d-1c24-4308-943e-b0ce0492b7a9", "sighting--cee293c5-2bd7-4ea6-81fe-6e20ba53c370", "sighting--dd706a6f-c83e-402a-b70a-8a7ab98dab15", "sighting--819c6c4a-49cd-4d54-a2fa-2c7e748eb973", "sighting--07d67f0b-2365-4a37-a696-1d100855f121", "sighting--f0ab2d88-f1ef-44d9-930a-d15ccd9a8b74", "sighting--ca671184-6fe5-481a-931f-8211cad99d84", "sighting--ede146b2-0edd-41cf-bdcf-ef86abcd6a93", "sighting--792836d8-4533-4dcf-8ba5-1e91fb4be763", "sighting--4dd40de7-2a04-4102-bd71-24f8c748f5a7", "sighting--7b7fa7fb-1720-4a6b-825d-310c20c09121", "sighting--f56ac345-a4ae-4877-8413-4f4e1dcc72e2", "sighting--6371a215-553b-4f9e-9928-68c601639769", "sighting--20e07a01-01b4-4cd6-a962-3eba03cc777f", "sighting--382be31a-0ce7-42fe-a2c7-ed258c321e00", "sighting--8a40693b-fd65-4e68-a990-c96e1359c36e", "sighting--1cddd35c-9637-4c59-9603-486584017e7a", "sighting--440fcf15-f69e-4b72-8dc1-cf680e4f7979", "sighting--bfd1971c-a9ce-460f-a01d-5bd1e9fb38c4", "sighting--b3aea48f-f14e-450f-89b4-da97f4e7b695", "sighting--1b1fd88a-ad82-405d-a25a-1d0b0d3ad223", "sighting--b1b46bf1-04a4-4ee4-bada-ff9b9cd9576b", "sighting--ca6b8c93-8e6b-4630-8f3e-898eb16549ef", "sighting--4aee649b-922b-43b4-be72-dc83524d81c3", "sighting--150af0ea-cce7-4e03-9f34-98c78121b20e", "sighting--8a54477f-9242-4991-af42-dece840d8db8", "sighting--9c7d7b74-96df-45ba-b293-8d8499216c2d", "sighting--50faf46a-157c-4edd-baf4-a736f86a5dab", "sighting--8a5fbeaa-d25d-4646-b333-3aed9b3a961f", "sighting--7e9571ea-0f6f-48d5-a914-6f9137cfd4c0", "sighting--6a3c83bc-8479-403f-bd4a-2ceac0329933", "sighting--04387777-0d2c-437b-b986-5f6f6a265498", "sighting--75f6568d-44c9-45c7-8b0f-85b9bc2b5007", "sighting--28ced6c0-c3e0-4727-b135-7d6d27391786", "sighting--73e97328-ed3b-421b-9834-c87fe27d2678", "sighting--28b0b6d2-5b63-4d2d-a18d-d88d5765093b", "sighting--e1ae7ec4-1035-4155-a4b3-9a0a351a0aac", "sighting--20708baf-b123-49b6-9280-8e0031c138ce", "sighting--3f3590f4-165b-4fac-813a-d8c35c548d1f", "sighting--5a123b47-b9f4-403c-9d13-60f4cf07e377", "sighting--f85e132b-ab06-4b5b-98e0-67ebfdbf3b4b", "sighting--071e2be3-0f8d-47bc-8523-0badf1815d93", "sighting--3cc17ee6-4a9f-4a25-bac9-1616f114bca1", "sighting--42bb35ca-a5a6-4d97-a7c4-884b99981057", "sighting--0f03615f-062e-456f-b7bb-01201afe2236", "sighting--e23af0d8-3fab-4fc4-88ff-aea54207aa0e", "sighting--2b9e1c1e-1976-4628-925b-959451a11370", "sighting--af14c328-00d5-4e44-be67-850f76daea4a", "sighting--09714246-6be9-47c4-b36c-f712c396b26e", "sighting--455b5626-0541-440b-ae48-ad0cc1215f95", "sighting--df825ef0-373b-46df-9533-b6115ee97c5c", "sighting--a96c1f17-c3a2-49be-af25-44ff5266f213", "sighting--68e33d5b-8946-4bf1-8e02-161bf5c73ed2", "sighting--b1c8b316-9a5d-4fd9-8eae-46b1f3df297d", "sighting--037ded1b-c3af-4e8d-9f65-5746c43683b8", "sighting--6a5ec103-8164-4a36-8127-5708638b4549", "sighting--0e4e939a-bb34-4e69-a9cd-38c976974fe8", "sighting--01827c86-2629-4dc4-b368-9aed25acdcba", "sighting--396cfa81-9437-4499-96af-5cc458a68078", "sighting--aed67fdc-7cc4-436b-8f03-9aaf595dca0f", "sighting--19846803-274f-4b8f-9dea-ee1ce24bac1b", "sighting--8a6ec3d5-ffe2-4259-a380-1754ca0a572e", "sighting--0ce2efca-d741-42a9-8f50-3851d234324c", "sighting--ee1c807b-a0e7-4f3b-8f7a-34937ca86bdc", "sighting--8367203c-d996-45bf-9725-30af4bed6de6", "sighting--3f1283de-25ff-454c-a231-1822cdef25d7", "sighting--6f4592a4-745d-4fee-98de-e90f65584811", "sighting--64a3356a-b38d-4ca7-95c3-162eeab00920", "sighting--2e026c6d-ec78-4cd4-a07a-df5ced1ab8d9", "sighting--e9c809a4-329c-4adf-aff5-4628a2c99567", "sighting--4c56ddaa-8897-4eec-be52-8b0494fb3526", "sighting--32aa1c87-0466-4416-96cf-b5f52ae211fe", "sighting--273d4587-b364-4d58-8540-fd98662fb4a2", "sighting--6328cd9c-d23b-4515-a6ea-0693c090e42d", "sighting--41a1a04b-6b67-4655-b5ad-025781b84aff", "sighting--e86f1502-542d-4aec-8c20-ee97e53ee2e7", "sighting--9bc9604b-4cf9-46b6-9e54-2d86ba5d42ee", "sighting--2de206bf-e5b2-4bcc-8048-05702bc68bcf", "sighting--78e2f713-c1be-4b72-ac23-5ea713da54b7", "sighting--bacc547b-5c00-4d9b-b4be-3f2a309dc6e8", "sighting--997a57a6-6fe0-45e3-b71f-907bde8a4cf6", "sighting--b70b9e90-b330-4fff-b046-b808546c04be", "sighting--105e142a-05fa-4c58-9852-cd4693c4535c", "sighting--f6a01441-b0a5-43e5-8a3f-f70f6aa79c2e", "sighting--c3e3af53-ce4f-4628-990e-33b875f204d7", "sighting--77bdbf36-72eb-413d-b063-ac85c5a39e15", "sighting--5f3e2dd3-2965-4331-8686-98f642d47b4f", "sighting--4742aa68-270e-40a2-8596-9d175ecd6fea", "sighting--00d30236-1346-4726-8770-d7d7572cdb92", "sighting--b14e1381-a66a-4dcf-b867-726495ce1181", "sighting--e548dabd-aa0b-4f46-82de-8fcffcf41725", "sighting--5b52478d-ad53-4c45-b2c4-ec6d391eccfd", "sighting--bbcba724-d7f2-4ca9-9266-4f0ea0c72869", "sighting--b2b66449-59f5-4870-aad1-9ae33a61dae5", "sighting--42ffd7b0-f31d-4668-a2f9-ad4ee3dbcebb", "sighting--dd269be6-79a6-4147-ad86-56bbb6b864d1", "sighting--3f4d58ba-5b6a-488b-99fd-4d394a116342", "sighting--8292f29d-2c82-40b7-9cca-ad02f45b1362", "sighting--53c24331-9f87-4c61-9f08-b160d0d8b23c", "sighting--deced8fa-6c7f-4696-b8e6-8e9c6dc30f07", "sighting--08daf891-2f4c-439a-ab9b-b94e12433904", "sighting--ee5b073b-467d-4a41-87a6-a2b9173d87f8", "sighting--f6decc54-923a-481b-87cd-8be75a906aa4", "sighting--aa64b340-32f8-4532-868d-d5a1d8fbb03a", "sighting--a97cb684-f3a5-44c5-b225-b07938e97adf", "sighting--9e81126f-f4a2-448e-af91-23574dc1ae11", "sighting--22d73b3c-6e2f-4769-b0f9-d6d85aad217a", "sighting--5aa5462a-6e3f-4c5d-bedc-87c437e973b3", "sighting--399c050e-fb28-439f-8431-ed163edfd04e", "sighting--ac65f42e-f13d-415f-83d8-fcd6ddee08f3", "sighting--912178d6-54c5-48af-8351-6db1edead9bc", "sighting--65a15a9b-13c1-48aa-a7a4-0963632cca82", "sighting--af5fdc81-06c1-4bdc-b69b-667119b0a08b", "sighting--ef36672d-0d73-4b4c-8357-4c33f80fe922", "sighting--dca036e8-8dc8-4b3c-b402-55674ec300e0", "sighting--e900d2ad-96f1-4eb5-acf4-af4a62d48ca4", "sighting--ddfc4bbc-531c-4146-bd66-e6e24b822631", "sighting--7a42ff40-1fbd-4e90-b179-77b13367231f", "sighting--cccc4f2c-dbc0-4d3a-9a27-7d2223943b11", "sighting--a78ee710-ebec-4b23-9ae4-f18f9d11c467", "sighting--c4e4af94-0201-4fcd-a22b-d3292e19848a", "sighting--61198495-3a96-4206-a325-561675a18a3d", "sighting--a470cc59-78c7-41f6-9f50-37fd307dbeee", "sighting--b6d77f33-dfb2-438b-998d-71fbba59c6be", "sighting--b222472e-d842-44e6-9b15-733c0e6e5469", "sighting--cbda17ee-62d2-4856-a121-a06fbbb2fbb2", "sighting--3a72103a-b8b9-4630-a3a8-dca288c49b45", "sighting--08a4b7af-7f89-4c11-a7a7-6c00bccca650", "sighting--10044df6-2415-4e26-a697-104296d594d1", "sighting--52a3ebe0-b277-436b-88c5-b84490acc7d1", "sighting--77f0cdd5-98d3-42a6-8789-4f9601c2ccd0", "sighting--b4e9e298-53ec-419c-8ca1-b05c20c66d3e", "sighting--ea697e8f-2e8d-4407-8670-c0d53bcbff84", "sighting--478ac963-11b9-46f3-893e-41a1b8cbf60e", "sighting--9460e984-442f-46da-84fd-f1facd82daa6", "sighting--8b861004-4e39-4683-aa23-f96c33e168b1", "sighting--ffd1d30e-b519-40fb-ab2e-c05a17060c9e", "sighting--9f333121-a37c-4d2a-9aff-4efdf7b73368", "sighting--f34ce517-5b88-49c5-a19d-2f02d77ab9e4", "sighting--60e0d79e-ffc7-4e9a-ad0d-5d9153d5a6c0", "sighting--f6df9523-23e3-426e-bc82-6ed735e28ffa", "sighting--c7d15446-98bf-48f3-96c0-e08e63087404", "sighting--3b0fa084-f75e-48f0-863f-87bb1cd3f0af", "sighting--2f87f955-08c9-455e-8533-a5c287a76944", "sighting--c669f24f-bca2-4b89-8bd5-83847bbaa32d", "sighting--cfc676bd-b745-4be5-bc5a-3c8e6e724650", "sighting--6ebd2d24-dbef-40f1-83af-b5779679cf1b", "sighting--5f353ed0-3711-48f1-970e-e35d4a7f3cd2", "sighting--08e0ee90-9b01-41d5-87cc-b0feb1bcd3db", "sighting--98333fe2-28d3-46ad-9d59-365bfff34b3e", "sighting--9e94e142-30d1-4224-a478-6c55ca52ac91", "sighting--ad075036-a16e-4ca7-b702-d796361c9a65", "sighting--d7f90e05-d796-444d-b510-fccd8182b6e0", "sighting--d7f55bba-8de8-4f29-9fa7-2985b5f7a356", "sighting--c609d221-aaab-49ae-8333-5cf859d4d145", "sighting--c9099307-81f9-4475-91f5-8b8241af0309", "sighting--84104f83-de55-4028-b2ab-de426a5365a9", "sighting--54fb3124-f82f-4cf0-8f16-b9a1297af24f", "sighting--1e1fb772-6285-4d5a-8617-aff397e45d69", "sighting--7209a35e-7a79-40fe-9ebd-54990992b5e2", "sighting--424954c6-5ca4-4087-8110-d60572586884", "sighting--4a4cada0-6c25-4598-8a9c-f00e87ffc75c", "sighting--0bd7112c-4495-43f0-b28f-07639c6fe51b", "sighting--7c9a4b57-ab9c-4e15-9b0e-2dc884236458", "sighting--804deee9-1563-42d8-8523-a64244abfa68", "sighting--2d3cbc97-30e4-4e37-870e-0f517d36cb67", "sighting--867af8e6-ccd5-46ed-bb4d-3def95b9df79", "sighting--628a4c62-b12e-4a37-83ab-044201f4af52", "sighting--ada16e7a-9a88-4699-90e0-321fb5f94f12", "sighting--522cee7e-906c-43ef-9c75-f3c68861580e", "sighting--631b55d7-d90d-4d00-8a1e-949f80462256", "sighting--ca137f9c-9ae0-4a25-bc99-d416701c64a6", "sighting--b60928b3-a0bc-4a2c-a19a-cd1e5c07d8fa", "sighting--6f5c5c27-10bd-4ddd-833b-dc73c85a67b1", "sighting--e83a5396-c60f-4c94-81a3-dc0e4ba92bb3", "sighting--a7041359-236f-4e23-8bc7-0bc462f1d2b4", "sighting--9710d99a-41b6-47a2-880a-be3b69c9c174", "sighting--da20c72a-226a-4940-9171-1da7b400777c", "sighting--2405f65b-8151-43a0-a82f-14cedcf9cb8b", "sighting--acd3400d-b021-48f6-a136-c0ccc205ca45", "sighting--a70f32b2-201e-41a7-ab4a-8a838a4ee3d6", "sighting--f87bf770-5d7e-4597-8d7e-18f0b5018df8", "sighting--5c8f2b11-cfae-4a33-856c-b58d6d1f34d4", "sighting--20116904-2cf1-4ccb-bbae-15d81e903fa7", "sighting--e469dc2b-4f2e-4d1f-ad9e-a42a687f071b", "sighting--772bd0a7-bf88-450c-9709-001f34b3ec56", "sighting--811a3918-2f79-45de-922d-698d13bf85e6", "sighting--b1989304-f8e3-453b-a875-a52e17d66175", "sighting--b9730529-c187-442d-b436-db3fcdcf819f", "sighting--560c331b-2b7c-485e-8eca-9562ba21ecb5", "sighting--83da3424-4ebe-42e5-8fbe-6bd73a9c0684", "sighting--a533257d-7e2e-4a36-b922-684929b90d80", "sighting--29b697d5-0dd1-4b2f-8b0b-ca5a3422b580", "sighting--bff48b2d-1b01-4d3e-8488-e5d0534af4a3", "sighting--0c1e7099-8d62-469a-bb30-b4555a422df6", "sighting--040ccdf9-30d8-4de1-9b4c-59c44d0230d1", "sighting--97d6f3e4-ef71-4160-8dd5-4999205be144", "sighting--987deddd-665a-4491-8dc2-9d44c342f765", "sighting--53d77571-baed-4f47-b4a4-cc63e6e6e46f", "sighting--5f6cfcbe-3e58-4890-ab54-c28a63250bea", "sighting--f83c93bb-ea48-4a22-b2c0-aa1bfaac090e", "sighting--90851fbf-1aed-4f53-9bd7-d1f5bff7eb3e", "sighting--c870ec53-782d-4250-b7d5-f1f466a80672", "sighting--1fe3c043-053e-4da4-a18f-256f1e3ca6b4", "sighting--eb37e04d-c9d5-42fa-836d-6921b34adca2", "sighting--7942c434-113b-4d80-b138-44f0d899114b", "sighting--403f5ca3-8112-4e12-be1e-6acf1c1f5ef1", "sighting--b137dcaa-c69e-4d03-8ecd-2766bc37facc", "sighting--1c77df6c-032b-4522-b178-29a96fe4de32", "sighting--5f5ddf67-04c1-4cfa-9b15-0ce32e9e529d", "sighting--190eff40-1fbb-4936-a625-ec30049f8997", "sighting--643740c7-5505-4583-b867-940ade6457be", "sighting--697a6939-565f-4550-8a37-242610750b14", "sighting--439594dd-09b2-4131-b7e4-5c66674c7b46", "sighting--4800e84f-257f-4bde-a2c9-cf0c8f3d35a8", "sighting--9b310b9d-34ff-4c8a-8195-9387f447aa4c", "sighting--3e1e262a-2a40-4aac-a622-bb832dc2dd23", "sighting--84645328-154c-4bed-8511-2af01b122af9", "sighting--03d694f7-450c-4186-931f-fa88ad613eaf", "sighting--3f6ef9e1-2c10-4673-abb8-9bb3f6d7ded3", "sighting--98b09b73-de3b-411a-94ba-b2afaeb3a5d9", "sighting--d75e17b6-8a0c-41de-8a36-e42cbd8f4d65", "sighting--56d2ae38-6299-48b5-8b1a-85bf951d6187", "sighting--aabb49cd-a18e-47f7-8d7e-57c08fd1ed62", "sighting--9d044b7f-ee84-4f91-88e1-c08e0f92e82b", "sighting--5d18b5fe-a7e4-4cca-8356-06f964b1ed05", "sighting--b1dfefac-2a57-45af-be4d-bba897239a30", "sighting--3d7f2577-cd94-43ba-b9cb-88be004a8c0c", "sighting--e9cd4a98-b7da-40da-b30a-93451eabba34", "sighting--e1e56b2b-ce47-4924-ab1a-08a445210f52", "sighting--ccd2695f-0d3c-4c93-9c3c-3753f79104b7", "sighting--0d736491-3567-455d-973f-1653eb5653b0", "sighting--7794abf8-f8cc-4a67-a1cd-7078a7109143", "sighting--4baa3f14-7b64-40b8-a407-7c38f18317b1", "sighting--436e10ae-dbb0-47f8-b7ca-3773b182f38f", "sighting--5f4e36a3-4255-466a-853e-798a97eec827", "sighting--d2362683-06a9-4089-9f39-6ef713f56106", "sighting--96c9bd53-3943-4d21-aa89-c23296d93c09", "sighting--75a16818-6a53-4d82-a751-ba64e1e66077", "sighting--3fc2b24c-0454-4e7b-8fc0-c2c2998bd8d2", "sighting--f2993163-fb5f-49ed-8d32-231291e4e157", "sighting--373aff4b-7013-4b33-bf01-4142fe146ba9", "sighting--107bac04-e8f3-42b9-80bb-0bcc3dd6783e", "sighting--86b8162c-13af-4e99-aee2-6d8db8816465", "sighting--7cfca0ed-6445-4bcd-a7c7-1fc9b49041e5", "sighting--68490e84-d8df-451a-9948-7a79ac4f6cb4", "sighting--56a999bc-7510-4ccd-9aac-e7665f826197", "sighting--73d1933c-4696-4513-bf26-86d54e7a874a", "sighting--4ff652fb-ea03-4d06-950b-f85b076663fd", "sighting--9a64ac93-64b3-4122-8f63-ab9d29751568", "sighting--64bd08e1-f0f9-4b31-974c-2fba7280feb3", "sighting--44abb5ea-0c45-4c2c-b0ac-0d5719dae546", "sighting--02f8d648-5c35-419c-ab09-7f6135b0f4ea", "sighting--9cf0bd36-e041-4c8e-aee9-d1bd14732fcf", "sighting--09af1bf5-ac26-4287-8eef-848c89b5daa5", "sighting--b242e774-0536-43fe-86a8-e1b565145a40", "sighting--da5b94a8-ee93-4020-83f2-b281023e8eae", "sighting--11e11355-2b1c-4c25-b5e6-39d6c5fee02f", "sighting--63aee9fb-4956-4452-bb24-10d8ff476258", "sighting--1a95f1e3-7135-4a11-8f6e-058a6b845277", "sighting--72c2ac01-4ea1-40b5-9e61-ccd1afa7b6c0", "sighting--04b124ae-f028-4feb-8b55-c3901074c8af", "sighting--9338120d-4cd1-4b6b-8090-2d3ef8a53b4a", "sighting--4bd529bd-5cc4-405f-bdee-f9082793a3ae", "sighting--2734d59f-e7b3-4c6e-9798-738f582da9eb", "sighting--bbf0203e-80aa-42f2-93c7-ed1b63206f56", "sighting--799111a0-1492-4016-af79-d7922caf1f52", "sighting--a3e7367f-fae9-4a17-b895-18943ab92e20", "sighting--feb8c9e1-5eb9-4980-a57d-c688df41b37f", "sighting--37ed59ae-a20f-4fba-9a6d-b986067ed67b", "sighting--38b82080-5196-441a-b1b3-18eff6e69af2", "sighting--91a7dfe1-991c-4283-9ea9-677a157123ba", "sighting--745b0584-839c-40e0-9959-3d3cad8ce3ff", "sighting--7270ca33-f73b-4e23-a7b0-a62c2fd804a8", "sighting--cf9e8ee6-a6b0-437b-95af-142fe0298377", "sighting--d6ce95e0-79f2-42d1-a39e-813cd9cb0289", "sighting--b6a71991-f214-4ef3-862a-d3dd0433ff49", "sighting--d6a3add1-7c88-4bb6-9199-64b9a5e47eb7", "sighting--05a9e9b0-f1b6-4a7e-90aa-44233b611895", "sighting--0b139733-bc34-438b-98fa-08759dbbc8d5", "sighting--56f1edb1-0e78-4f95-a865-218c9acef287", "sighting--1365fb8e-4c00-4446-b88a-55405fc3b4d8", "sighting--3e08388b-65e5-4a96-9bd6-1278fe026e9b", "sighting--3cef9a28-9f30-44ca-9eb9-38eea17df3d3", "sighting--1fb49456-1330-44b7-8d10-79447a905342", "sighting--29222010-8226-4326-b54b-35cd482af0d7", "sighting--3f620165-e7be-456b-bc96-6b3f33d2b6c7", "sighting--914c9216-bdf4-4f08-b0ff-8c3eefa8b4b0", "sighting--ee4205f5-dc4a-4725-a2da-f118c36b7d05", "sighting--90cfdfbc-7384-4add-9ced-50593cbcb524", "sighting--d69695e8-3b61-4be4-baec-a2c76082a20f", "sighting--ede73591-c98f-4070-93b6-239c086d9dc7", "sighting--7ffe66df-1d4c-4450-b24f-d59690fd66e4", "sighting--7fccda0b-6678-4e6b-a774-6b0f28523396", "sighting--5283db8a-510b-421d-878c-39c5589d160d", "sighting--e86a432d-cd44-4c6d-ae11-73e1d8020ec8", "sighting--201c77fb-b516-4731-a632-435b4f74a573", "sighting--87075eca-4e27-48d9-98ff-dded1d3c7818", "sighting--6272f69b-266d-4d94-a325-90c9c2b696bc", "sighting--739ac174-786c-46f1-9196-e40e83e4a656", "sighting--0a540da6-a75a-4cbf-831c-e11ccea8c29d", "sighting--7a7c8b35-c916-460e-804e-ae344afd2583", "sighting--66ff4f6f-4130-418a-ab24-2a861feb8615", "sighting--edd8ad9a-cc97-4c2e-8541-e903cec68c8a", "sighting--e21ca087-f8a5-4b21-854c-3bc00767ba3c", "sighting--cf3032e1-3df6-43e2-afde-79ed5c9088f5", "sighting--60813fdd-6f83-4cb4-aa12-9a772fe115d8", "sighting--4dcd493a-bfb4-4b7f-9ed0-5139ae870948", "sighting--e06d616c-12ac-41e7-a550-10573f6d335f", "sighting--4a5095b1-c090-45a8-ab9f-bb567701eb41", "sighting--fa0bef6d-d5bc-484f-ab54-f225655333ba", "sighting--729c055e-caa3-491a-8664-9a75c11a33c9", "sighting--67a85d4e-1c59-470b-84d5-8f7584b4eec5", "sighting--14e0108b-6f43-40ca-80e2-cd2c1d466f24", "sighting--a708af06-0261-47a1-8c75-956c77545113", "sighting--57fe90e0-d16f-4457-acc9-4ae031c6b0ce", "sighting--d028d84b-7a44-408d-b674-9dad82aabe59", "sighting--c18edf89-d7bf-4c7e-9ce4-b033b243426c", "sighting--94b61a09-2377-41fe-8909-8f7e34855240", "sighting--a0041f4a-0804-4e81-8fdc-bafd18cff133", "sighting--dd8c989e-e8d6-49c0-9f2c-e76a51b793a6", "sighting--8035326d-1631-48d9-b988-79a3fe75a9ef", "sighting--5eb97bba-44ab-4d78-9ecb-4f11412d325f", "sighting--7bd50fd0-0038-41d2-aa59-59ef01475fc4", "sighting--30e3d6f6-febe-418a-81a5-5c3870f267f2", "sighting--b12e2ce7-1d85-46ac-ad05-b71b9a6b079d", "sighting--c96f6725-6541-4795-a41e-293b4381f9f0", "sighting--0645676e-2713-4666-a4b0-babd649423ad", "sighting--7a69a12e-b655-4abb-afb0-6d138871ed77", "sighting--322c8007-2c72-4ddf-9bd8-d146cf91f802", "sighting--c31c75d3-4089-409b-8a16-3ecdb247b480", "sighting--3ec1214f-6c9c-4496-a9b5-ff84b0caee8c", "sighting--454a7af3-32f1-41ec-8e88-3cd2fce70b17", "sighting--c1532cdc-06bc-4515-bbc8-f53a271bb75d", "sighting--49d4fee0-39a8-4761-af73-74bddf010592", "sighting--8e6e5ffb-996f-4589-b750-7e429f6fbef6", "sighting--7bbadbc6-1b2f-4de9-a548-0953be45001a", "sighting--7d24763e-1954-40a4-83b1-434b919f69c9", "sighting--28fd7b2a-bf83-4cae-9e0e-e245e2cbba17", "sighting--002c7e79-5d40-4f5c-801f-ab93a33e0036", "sighting--8a1eb832-e4b0-40d9-9459-3e1bb7c922f1", "sighting--88613ba4-913a-48ba-842f-fa2b1a13b69d", "sighting--b0ca27b5-862e-4fee-a1bb-65a4e8835c31", "sighting--51cf921c-1ab0-4cc8-83bb-d8bd231d581a", "sighting--257371e5-a88f-4472-a135-b0191a51fa32", "sighting--3a4ba22a-38ab-47a8-b4a4-15b908a2038e", "sighting--01a24ed8-0e21-429b-8766-1d9c30ea1a57", "sighting--5db61f3d-f93e-44b0-8ddc-85c243d6a80c", "sighting--c277fbb4-fbfa-4e32-9caa-471d33afbc5f", "sighting--c02f2f78-fce5-424d-832a-3413ffffcecb", "sighting--eeac75ac-bf77-4b60-9069-f1f258d38386", "sighting--f2dd1a44-f545-48c4-b502-92d2e0bee352", "sighting--6d9b0630-b9ce-4b9f-9d95-10e4e8b9b387", "sighting--647f7dfc-3d6c-4bc6-93b3-ef683c4a5800", "sighting--59a73d6d-83c1-4edf-8f9f-65fccfb992c0", "sighting--2ede4e9f-3f10-4b78-8d37-d95eb58a2d7a", "sighting--d4691284-3c2a-4d45-8a80-a08e709904e3", "sighting--b180117c-b6c3-4801-a322-eb6c5c4cb18a", "sighting--7b2f5c53-416f-4d94-bf7a-9802853664d1", "sighting--3018c468-f0ae-4962-92d0-3f0e36dfc119", "sighting--91dc9b90-da6c-4eca-93b1-a0d805367bfa", "sighting--25fad508-f06b-441b-bc80-61d7e41ef5d4", "sighting--da7dd5b4-03ac-4c73-b929-e6f478113873", "sighting--f6810116-8640-4ec4-bddb-ca547c6305bc", "sighting--14533c8f-91bc-4e41-a007-64bfcc181776", "sighting--bea81f41-cfdd-4334-b008-8d34fceb234e", "sighting--36596dd3-7ac4-4f32-91da-77ddca283523", "sighting--89c36ad0-3424-41ad-b01d-714ecd352ada", "sighting--b39690db-10f6-4d1a-b1fd-c442547a80c2", "sighting--453b489d-84eb-4435-a0e2-42e33a156860", "sighting--80ea0dd8-a055-4a7d-a580-fdd535814a86", "sighting--440c080a-80cc-4955-9662-ea4add8eb588", "sighting--69e65a80-754b-4bef-8ec3-36ff03e8c8a1", "sighting--752baa19-33fd-4d2e-972b-c3861cf0f70f", "sighting--c0e83d9a-065d-4f7b-86b7-b87ba7030e7e", "sighting--7972798e-9eaa-4cb8-bc0a-baf069a09069", "sighting--f36fca3f-b03a-4f86-82bd-708e883a8a48", "sighting--47a3285c-0770-45be-b510-3d3179612e1c", "sighting--af2f0727-604f-4dfd-9c77-d10ab2a29afc", "sighting--8a795472-bef7-40f5-8d01-14af3a3e3870", "sighting--27de42ee-5c87-4c25-b973-441b8d28865a", "sighting--2c5cbc0a-c305-42ff-bb67-4043cb1a0890", "sighting--e342c79a-32dd-44e0-ad05-ecf78e7f6a9f", "sighting--2d7e262d-c520-4373-a798-534b522ac383", "sighting--0c68e6e7-d421-4bdc-b5aa-8ccaa016a9ff", "sighting--ef4d02c0-1156-4184-b45f-1d3194e54d72", "sighting--fc5b24e8-44e7-4daa-9152-c3af5045e1bd", "sighting--a5dd08db-bbfb-4d0f-bb96-e8d5cb1803de", "sighting--2d732321-ec53-48d3-bb7c-c73c5f8a88e7", "sighting--83f857da-ac59-40a9-956a-fc3a458f2736", "sighting--5aa1fffa-ac31-4ef6-b82d-22d0e21199ef", "sighting--82dbfff0-33e9-4075-b0b0-8338e1b8801f", "sighting--5e571223-14ad-4c53-9617-5c4ebf282c27", "sighting--f0ba1b44-88fa-4311-acb2-b5f08b5aaa91", "sighting--1e61ebdd-9849-4f7a-a985-39a595ffbe1b", "sighting--312d2d5f-5112-4035-a9a8-6b4210047d20", "sighting--af973063-3885-4317-bb24-72ed725bd888", "sighting--fa961da1-3fd0-4d7f-9a3f-169cbb2fd690", "sighting--d1d8b7a4-d230-494c-92cb-b6c891aa193c", "sighting--832e2e75-935f-4999-bd39-38a84f1edc0e", "sighting--4eb1005d-709a-4d62-bd7c-e9123959622d", "sighting--a14e7fb6-7f86-4c95-a377-29428aa18fa9", "sighting--57db024d-9c2d-4084-90ec-d5f541556536", "sighting--71f218ec-2112-4411-b713-bc1f31d0aac6", "sighting--218b0495-4c93-47c7-8910-82aad66ca576", "sighting--31913d8a-7dcb-4cdc-9fc5-170c64684281", "sighting--ea782d65-1b3d-465e-92fd-513a7719d052", "sighting--dd1145aa-b62b-4c0b-a74c-55763f62253a", "sighting--817cfce8-7bee-4883-879a-061286b815a4", "sighting--35795178-4e97-4d1b-8742-0e06d1d39085", "sighting--32c978e0-9a39-4779-92b8-f2f00301eeda", "sighting--3d742f3c-93a3-41b2-893c-fe042f45a0c3", "sighting--57e451f2-030c-4dde-ab76-92f504d36828", "sighting--586a87b6-7f3f-4a36-a3da-a59f77fd957b", "sighting--b19ed47e-6da5-4368-a5d7-82fd4a7accb5", "sighting--088a8cad-b78f-480a-9749-5ca67546baf4", "sighting--e1e38e32-4079-47e7-a454-870cb01f2e91", "sighting--e6346392-c1fd-4ccd-b888-e697b26dc889", "sighting--98d0a0ba-1a65-47f3-8b0f-3161d3c16160", "sighting--bb44a659-4050-407e-8fa3-a8259df7f823", "sighting--97ccc534-6db3-4880-a676-81f5b7c2d8f2", "sighting--9b4f01e8-a557-4ee3-bb56-c3434a5826b9", "sighting--497ae187-4413-4fe4-abd7-e469071c41da", "sighting--f0c4b831-a37a-4b49-9a6c-7ce8b14f31d3", "sighting--4e3739b8-cb04-4522-9e5f-e247e6576305", "sighting--35c0a06a-0161-4e65-a12f-575dad25f44b", "sighting--a78ed0ed-ec39-4ada-8031-5d85c96fa14b", "sighting--06c344f8-f6b2-4360-8318-4a569d6302e0", "sighting--bf63f1a6-4770-4189-bc85-2703bdb57125", "sighting--c52504b5-57fa-44d0-8044-6c7b754bd782", "sighting--f4a138d0-3598-4213-8e17-bc02c3080f87", "sighting--6a390f8b-0dfe-4e29-9cc5-59bfc2d51071", "sighting--2267b5da-7643-448d-878c-a43f87e506d7", "sighting--71d87176-b152-4d4d-b7b9-9cb82b85e5bd", "sighting--bae586bb-3e15-4dbf-9ae9-08ebd6ca9dbf", "sighting--410f8242-080d-408e-a3a2-26414df476a1", "sighting--428e8f20-a557-43e8-98dd-01f1cf10dbf7", "sighting--620d7594-e07c-405d-aef7-c48bf27a6e6c", "sighting--e83c2e8b-0bc7-485b-883d-4652be6febf0", "sighting--7a8fffee-dc15-4797-9b5c-b9090751d5de", "sighting--7fa62713-10ce-4ad5-9200-b8d66d4d4a0c", "sighting--d8a5f5c7-f90a-4d13-96ff-a9398bceb7c3", "sighting--3d385386-a2b7-4d3d-b0a8-d14ce57e271a", "sighting--2ede8248-284e-4613-b0f1-9d92d0ae0695", "sighting--73bd6480-5370-4157-9746-88237be0a5da", "sighting--ec44d62b-ddc2-441c-a648-aeb4dd0ff4ef", "sighting--84037c8a-ab34-4456-bad3-3364deb924a0", "sighting--48b17a79-327b-41de-aa0e-ba20223eb9ed", "sighting--87044812-cb60-49e5-8cc2-08fbef6282b6", "sighting--af3624c4-69b6-467c-81bc-c5039a60f8e9", "sighting--78313d7b-f344-403b-84ae-9ec5f4c37793", "sighting--d61a14a4-916b-4454-bc10-800cbe067fbd", "sighting--b750cb34-b80e-49f9-82ed-40224fb0913a", "sighting--dd7b5fcd-388f-44a0-8e28-fc224b52edb8", "sighting--b22639ea-e496-4c2e-8573-0d3e8f3696b4", "sighting--4a3b0eb4-f476-409a-bf8d-03a53dfdbbe3", "sighting--31f4833b-26e3-4f87-a382-ddc688906d6c", "sighting--4e878969-0f30-4440-a660-0aa466113fd1", "sighting--15f44b0b-eef1-44b6-87b7-f55e611a50dc", "sighting--03275ba3-07b4-4671-8388-73db6e7b5e38", "sighting--10dab701-d394-49b0-b4e1-915d248e1d3f", "sighting--ce8b450d-a27f-4b08-968d-a6dc9e57d446", "sighting--65c0e460-0bfa-4a5b-8b8d-cf7edd6a7484", "sighting--3be1bed3-2e5f-4873-9665-4a160f7214c4", "sighting--43fc5268-eae7-49bf-bf34-046ca0f2489d", "sighting--0598a4eb-942c-4353-8241-9201e5cd5770", "sighting--58a681e6-a28b-4b10-bb1a-9be31275650a", "sighting--6677cb28-c2f0-4145-86a7-69c026c9f333", "sighting--bec21ad9-12cc-4fef-8109-6d1a237ab534", "sighting--4f8fc851-eaac-4367-9f00-80e5a799d5bb", "sighting--553e0627-01fa-436a-9d59-7a50aed02e66", "sighting--5d977086-e06c-4a21-9890-6d09a7c4c1be", "sighting--e0639d5f-1aaf-42ba-b16d-0714aecac432", "sighting--28637927-e96e-4d23-9afe-bc525ae65c10", "sighting--5b924a8f-a6b2-4b5f-9c60-ba53381cb5c9", "sighting--1c304ae9-233a-4d87-b936-17c4ef889296", "sighting--d737ff62-4fb4-4c62-a27e-9c1eaff1126d", "sighting--8a4e236a-e629-4c7d-befe-ab38c143b242", "sighting--b3d8ede0-728b-491c-bc69-a18f60d8e73c", "sighting--2d80520e-cf6d-4883-b895-ac018b0ff5fd", "sighting--b24fc9e9-208c-42bd-9267-24c65a624373", "sighting--f29e628c-b17f-4956-8517-54dc4aee1deb", "sighting--31a5b3d6-0a0e-41b2-9875-d7eb3245dbfd", "sighting--6d17f6ec-7337-4e98-854a-46e0e0bd5258", "sighting--034fe2fe-f6c0-4fa7-8ff7-8627c34de1ab", "sighting--e1a4ff42-7fa3-4a7c-a79a-2a89bd189a4e", "sighting--9d42b9c4-9f12-4537-9ff4-d0aee5dd6978", "sighting--2f7f3539-3215-418f-b2cb-05a4f57b2311", "sighting--fc17054e-1f18-4a45-bf09-4b744dcc82f8", "sighting--ca67619f-9069-4943-9f49-af1f667c8cbd", "sighting--1bd12962-b329-4d88-adf3-923fc96d3c63", "sighting--72b30b5c-bdca-4f54-9cab-956882ea0feb", "sighting--87ca7630-720f-4cee-b931-f0336cbc4bff", "sighting--8533665f-f604-486a-9f6d-5a7b1200224c", "sighting--c10cd281-18ec-4e74-97b4-fc1b3a63c82e", "sighting--108edfcc-d456-45a9-b675-07e8257d9b83", "sighting--4f543bf3-aeb6-4bd5-b857-e6e8d9b59857", "sighting--b02f8396-16d3-4fb7-a8d6-3a109e0f1d10", "sighting--3a02e114-23d9-423a-80c5-acebe63c2caa", "sighting--3db1304f-2d57-403f-9a4f-7bdbb46a1c0f", "sighting--b0bcc92d-0aa0-4a3b-8b08-3e2cc78f7622", "sighting--1e743ec4-9d02-4a7c-bc28-1e2d22fa1ccf", "sighting--8ca44494-359d-4a74-94c4-aaebc621a30b", "sighting--ba4c6adf-062f-4694-b33f-ae7a1459179c", "sighting--138ea6b0-0e4e-407c-8d9c-15de678e0990", "sighting--1f62c1e1-91dd-45d5-ae88-13b5c663faf3", "sighting--85a51012-0709-4ff7-83f9-11086f2f0766", "sighting--269cfe09-8bb9-4dd4-a55c-72c16131593e"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-29T11:00:01.567Z", "modified": "2026-05-29T11:00:01.567Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}